multiline: cri: Use non-greedy parsing for parsing time

[danlenar]

Fixes #4377 and #5010

If a pod logs in cri format, you potentially have fluent-bit parsing this

<time> <stream> <_p> <log_a>
where log_a is also in cri format
<time> <stream> <_p> <log_b>

This causes time regex to be greedy and you run into issues of invalid time format and time string length is too long.

This also causes fluent-bit to go into an infinite loop of rejecting its own logs

./fluent-bit-containerd-7dfm9_logging_fluent-bit-7faa06256bcf2ec5b526ce780d77c60f1fe10e92649679891ecb9c5b3f1f8efc.log:2022-03-14T16:24:20.770455995-06:00 stderr F [2022/03/14 22:24:20] [ warn] [parser:_ml_cri] invalid time format %Y-%m-%dT%H:%M:%S.%L%z for '2022-03-14T16:24:18.778252457-06:00 stderr F [2022/03/14 22:24:18] [ warn] [parser:_ml_cri] invalid time format %Y-%m-%dT%H:%M:%S.%L%z for '2022-03-14T16:24:16.798195119-06:00'

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• [N/A] Debug log output from testing the change

• [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Attached local packaging test output showing all targets (including any new ones) build.

Documentation

• [N/A] Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[leonardo-albertovich]

I wonder what's better from both a performance and clarity point of view, a non greedy "dot" or a character set that excludes spaces.

I think this is fine regardless.