"failed to get realtime timestamp"

[MostFrabjous]

For confirmed bugs, please report:

• Version: 7.0.0
• Operating System: CentOS 7.6.1810 (Core)
• Discuss Forum URL: https://discuss.elastic.co/t/cant-get-journal-beat-docker-image-working-on-coreos/177533
• Steps to Reproduce:
  • Install and run journalbeat

After a fresh install of journalbeat, I don't recieve any logs on remote server and get a log of ERROR logentries from journalbeat.

• Install journalbeat via rpm (7.0.0)
• Configure journalbeat

journalbeat.inputs:
  - paths: []
  seek: cursor
  include_matches: [systemd.unit=docker]

  fields:
    env: test

output.logstash:
  hosts: ["$LOG_HOST_FQDN:5044"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

After starting a lot of these errors are logged:

2019-04-25T12:48:30.890+0200    ERROR   [input] input/input.go:169      Error while reading event: failed to get realtime timestamp: 99 {"id": "78d2e578-445e-4dd9-b36a-98e9ebf7f60e"}

[MostFrabjous]

This works if I remove include_matches: [systemd.unit=docker] --> may be closed

[kvch]

When there is no new entry to read systemd returns this error. It does not lead to any data loss on user's side.
We need to detect if there is no new messages and suppress this error when it's not appropiate.

[zhanglei216]

you should change this line of configurations file.

""
include_matches: [systemd.unit=docker.service]
""
or
""
include_matches:
- systemd.unit docker.service
""

[mvanderlee]

For me this was a permission issue. I ran journalbeat in docker using docker.elastic.co/beats/journalbeat:7.2.0 and forgot to run the container as user = root.
After that it worked great.

[urso]

Looks like the issue has been resolved. Thank you for sharing how you fixed it.