Change:
<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.--Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see ): no What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): fluentd timezone timeformat Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT <!-- If this is a BUG REPORT, please: Fill in as much of the template below as you can. If you leave out information, we can't help you as well. If this is a FEATURE REQUEST, please: Describe in detail the feature/behavior/change you'd like to see. In both cases, be ready for followup questions, and please respond in a timely manner. If we can't reproduce a bug or think a feature already exists, we might close your issue. If we're wrong, PLEASE feel free to reopen it and explain why. --Kubernetes version (use ): What happened: Log lines from docker have the wrong timestamp. Anything else do we need to know: We are building a custom Docker Image for fluentd/td-agent which is based on your Dockerfile but with some slight changes. One of which is that we set the timezone to something else than UTC. In this case fluentd will produce wrong timestamps for log lines since the string only includes a simple Z in the end. Changing the time_format to fixed the problem for us. Of course this is not really a bug in kubernetes but changing the default to the above will probably help others in the future.
Thanks for reporting! It seems to be a bug

Discussion:
apiVersion: extensions/v1beta1 kind: DaemonSet metadata: <del> name: fluentd-gcp-v1.34 </del> <ins> name: fluentd-gcp-v1.35 </ins> namespace: kube-system labels: k8s-app: fluentd-gcp kubernetes.io/cluster-service: "true" <del> version: v1.34 </del> <ins> version: v1.35 </ins> spec: template: metadata: labels: k8s-app: fluentd-gcp kubernetes.io/cluster-service: "true" <del> version: v1.34 </del> <ins> version: v1.35 </ins> spec: containers: - name: fluentd-gcp <del> image: gcr.io/google_containers/fluentd-gcp:1.34 </del> <ins> image: gcr.io/google_containers/fluentd-gcp:1.35 </ins> # If fluentd consumes its own logs, the following situation may happen: # fluentd fails to send a chunk to the server => writes it to the log => # tries to send this message to the server => fails to send a chunk and so on.

.PHONY:	build push PREFIX=gcr.io/google_containers <del> TAG = 1.34 </del> <ins> TAG = 1.35 </ins> build: docker build --pull -t $(PREFIX)/fluentd-gcp:$(TAG) .

time_key time path /var/log/containers/*.log pos_file /var/log/gcp-containers.log.pos <del> time_format %Y-%m-%dT%H:%M:%S.%NZ </del> <ins> time_format %Y-%m-%dT%H:%M:%S.%N%Z </ins> tag reform.* read_from_head true </source>

dnsPolicy: Default containers: - name: fluentd-cloud-logging <del> image: gcr.io/google_containers/fluentd-gcp:1.34 </del> <ins> image: gcr.io/google_containers/fluentd-gcp:1.35 </ins> # If fluentd consumes its own logs, the following situation may happen: # fluentd fails to send a chunk to the server => writes it to the log => # tries to send this message to the server => fails to send a chunk and so on.