发现docker容器发过来的日志记录文件中时区是错误的，差八个小时，可以确定是时区的问题。
进入容器验证时区设置

[root@localhost log]# docker exec -it fluentd /bin/sh
/ # date
Wed Apr 10 05:06:07 UTC 2019
/ # cd /usr/share/lo^C
/ # cp /usr/share/  # 发现没有zoneinfo目录
apk/              ca-certificates/  man/              misc/             terminfo/

# 查看系统版本

~ # cat /etc/issue 
Welcome to Alpine Linux 3.8
Kernel \r on an \m (\l)

系统为Alpine linux，这里需要用apk这个包管理器安装tzdata这个包

~ # apk add -U tzdata
fetch http://dl-cdn.alpinelinux.org/alpine/v3.8/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.8/community/x86_64/APKINDEX.tar.gz
(1/1) Installing tzdata (2018f-r0)
Executing busybox-1.28.4-r2.trigger
OK: 29 MiB in 28 packages
~ # cp /usr/share/zoneinfo/
Africa/       Atlantic/     Canada/       EST5EDT       Factory       GMT-0         Iceland       Japan         MST7MDT       PRC           ROC           US/           Zulu          zone1970.tab
America/      Australia/    Chile/        Egypt         GB            GMT0          Indian/       Kwajalein     Mexico/       PST8PDT       ROK           UTC           iso3166.tab
Antarctica/   Brazil/       Cuba          Eire          GB-Eire       Greenwich     Iran          Libya         NZ            Pacific/      Singapore     Universal     posixrules
Arctic/       CET           EET           Etc/          GMT           HST           Israel        MET           NZ-CHAT       Poland        Turkey        W-SU          right/
Asia/         CST6CDT       EST           Europe/       GMT+0         Hongkong      Jamaica       MST           Navajo        Portugal      UCT           WET           zone.tab
~ # cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime 
~ # date
Wed Apr 10 13:13:57 CST 2019

重启fluentd容器解决。