<p>I am trying to parse the logs from kubernetes like this for example</p>

<pre><code>2018-08-14 13:21:20.013 [INFO][67] health.go 150: Overall health summary=&amp;health.HealthReport{Live:true, Ready:true}
</code></pre>

<p>And this is the configuration</p>

<pre><code>&lt;source&gt;
  @id calico-node.log
  @type tail
  format /^(?&lt;time&gt;[^ ]* [^ ,]*)[^\[]*\[[^\]]*\]\[(?&lt;severity&gt;[^ \]]*) *\] (?&lt;message&gt;.*)$/
  time_format %Y-%m-%d %H:%M:%S
  path /var/log/containers/calico-node**.log
  pos_file /var/log/es-calico.pos
  tag calico-node
&lt;/source&gt;
</code></pre>

<p>According to regex101.com, this pattern should match this string. However, I get an error from fluentd while trying to parse this</p>

<pre><code>2018-08-14 13:21:20 +0000 [warn]: [calico-node.log] "{\"log\":\"2018-08-14 13:21:20.013 [INFO][67] health.go 150: Overall health summary=\\u0026health.HealthReport{Live:true, Ready:true}\\n\",\"stream\":\"stdout\",\"time\":\"2018-08-14T13:21:20.013908223Z\"}" error="invalid time format: value = {\"log\":\"2018-08-14 13:21:20.013, error_class = ArgumentError, error = string doesn't match"```
</code></pre>

<p>What could be wrong? I have had similar errors with the built-in parser for apache logs as well?</p>

<p>From what I can see, you are missing something in the <code>fluentd config</code>.</p>

<p>Your <code>time_format %Y-%m-%d %H:%M:%S</code> will not work with the timestamp <code>2018-08-14 13:21:20.013</code>, as it's missing <code>.%3N</code>.</p>

<p>It should be as follows:
<code>time_format %Y-%m-%d %H:%M:%S.%3N</code> or <code>time_format %Y-%m-%d %H:%M:%S.%L</code></p>
