Amazon-ecs-agent: Issue with awslogs-datetime-format

[leonblueconic]

Summary

Issue with awslogs-datetime-format

Description

When using the following in as task definition:

      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "DockerLogs",
          "awslogs-datetime-format": "[%Y-%m-%dT%H:%M:%S+00:00]",
          "awslogs-region": "eu-west-1",
          "awslogs-stream-prefix": "nodeapp"
        }
````

The containers fails to start with the following message:

Error response from daemon: awslogs could not parse multiline pattern key "[\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[1,2][0-9]|3[0,1])T(?:[0,1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]+00:00]": error parsing regexp: invalid character class range: }-(
````

Expected Behavior

That the container would startup and would be able to successfully parse the following log sequence:

Debugger listening on ws://127.0.0.1:9229/cf6e748d-f5e7-444b-a462-c0fc8ac57b35
For help see https://nodejs.org/en/docs/inspector
[2018-01-18T23:28:53+00:00] <INFO>  [/nodeapp/myapp/app.js:77] Using custom HTTP parser instead of default Node.js HTTP parser.
[2018-01-18T23:28:53+00:00] <INFO>  [/nodeapp/myapp/app.js:80] Out of Memory detection is enabled for all workers. Threshold for creating heapdump: 70% of heapsize used after full GC.
[2018-01-18T23:28:53+00:00] <INFO>  [/nodeapp/myapp/middleware/requestValve.js:20] Toobusy settings; maxlag='140ms', interval='2000ms', max # requests open=100
[2018-01-18T23:28:54+00:00] <INFO>  [/nodeapp/myapp/model/master/initApp.js:35] Succesfully created work directory.
[2018-01-18T23:28:54+00:00] <INFO>  [/nodeapp/myapp/model/master/initApp.js:50] Succesfully created interactiontypes directory.
[2018-01-18T23:28:54+00:00] <INFO>  [/nodeapp/myapp/model/master/initApp.js:76] Succesfully created node_modules directory.
...

Yes, unfortunately the first line will not contain the datetime pattern.

Observed Behavior

Container fails to start.

Environment Details

Amazon ECS-Optimized Amazon Linux AMI 2017.09.f
with updated docker install to 17.09.1-ce

[aaithal]

Hi @leonblueconic,

It seems like the Docker daemon is rejecting the regex that you're providing here. Can you please validate that the regex is valid as per Docker docs? If it's valid and the daemon still rejects it, you can open an issue in this repo to track it: https://github.com/moby/moby. I'm closing this as this doesn't seem to be an issue with the ECS agent. Feel free to reach out to us if have any additional questions/comments.

Thanks,
Anirudh

[samuelkarp]

This is likely a bug in the awslogs driver in Docker. The driver converts the strftime format specification to a regular expression and then tries to parse it with Go's regex library, but the [ and ] characters seem to be breaking the conversion logic. I'd recommend trying \[ and \] for now to see if that gets it working, and then opening an issue in the upstream moby project repo to report the bug.

[leonblueconic]

Indeed. It seems I have to use

"awslogs-datetime-format": "\\[%Y-%m-%dT%H:%M:%S\\+00:00\\]"

to avoid the error message and get the regexp correct.