# Avaya CDR Data in Elastic **URL:** \ **Category:** Logstash\ **Created:** [October 30, 2024, 4:48pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837 "2024-10-30T16:48:20Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Post date:** [October 30, 2024, 4:48pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/1 "2024-10-30T16:48:20Z")
Hello everyone, We are ingesting some Avaya CDR data in our Elastic 8.11 and this is how the data looks like: \u0001\u0001\u0001\u0002\a\u0001\u0000\u0006\u0001\u0001\u0002\u0001\u0006\b\u0001\u001E\x81 I see the below messages in my logstash logs: [logstash.codecs.line][avaya-cdr][7a861177e896f2b58696b6f2fa4a8cc43d896fc2089b4bc7d61d5a0f9dd3be96] Received an event that has a different character encoding than you configured. {:text=\>"\u0001\u0001\u0001\u0002\a\u0001\u0000\u0006\u0001\u0001\u0002\u0001\u0006\b\u0001\u001E\x81", :expected\_charset=\>"UTF-8"} I've tried to update the codec settings in my logstash filter file to ASCII-8BIT, UTF-8, ISO-8859-1 but none of these settings seem to change the data format. Is there something that I am missing? This is how my input conf file looks like: udp { port =\> "xxx" type =\> "avaya-cdr" codec =\> line { charset =\> "ISO-8859-1"} tags =\> ["avaya-cdr-udp-8516"] } tcp { port =\> "xxx" type =\> "avaya-cdr" codec =\> line { charset =\> "ISO-8859-1"} tags =\> ["avaya-cdr-tcp-8516"] } Please let me know if there is something else I need to do to translate the Avaya CDR data in Elastic. Thank you ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 30, 2024, 6:53pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/2 "2024-10-30T18:53:02Z")
> [@nitesh.srivastava](#): > > I've tried to update the codec settings in my logstash filter file to ASCII-8BIT, UTF-8, ISO-8859-1 but none of these settings seem to change the data format. Is there something that I am missing? What is the charset being used by the source? Also, are you sure this isn't some kind of proprietary format? Maybe you need to use a proprietary tool from avaya to export the raw data. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [October 30, 2024, 7:47pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/3 "2024-10-30T19:47:24Z")
> [@nitesh.srivastava](#): > > UTF-8 Have you tried with UTF-16 or UTF-16 LE? ---
**Author:** ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Post date:** [October 31, 2024, 1:00am UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/4 "2024-10-31T01:00:38Z")
Thank you @leandrojmp. I will check and find out the charset used by the source. ---
**Author:** ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Post date:** [October 31, 2024, 1:02am UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/5 "2024-10-31T01:02:36Z")
Thank you @Rios I tried with UTF-16 and UTF-16LE and all I see is a bunch of ???????? ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6f48cb407cf646587e41d636284b481f64cb19a.png) ---
**Author:** ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Post date:** [October 31, 2024, 8:47pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/6 "2024-10-31T20:47:24Z")
@leandrojmp not sure if this helps but this is what I got back regarding the source charset ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bc5df9e66f8f78ac107e2768243dd14eee07bdc.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/81a410a24a568514ac5d2d81f934766246519101.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 31, 2024, 9:31pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/7 "2024-10-31T21:31:32Z")
I've never used them, but the documentation for the Avaya CDRs certainly suggests to me that they are plain ASCII. I don't think they use anything that would differ across ASCII / ISO8859-1 / UTF-8. There an old PDF [here](http://support.avaya.com/elmodocs2/comm_mgr/r2_0/245801_1_1/233506_7/233506_7.pdf). Start at page 1440. There is more current documentation [here](https://documentation.avaya.com/bundle/CMFeatureDescriptionandImplementation_R8.1/page/CDRrecordformats.html), and it doesn't look much different. How is data getting from the output endpoint (CDR1) to logstash? ---
**Author:** ![nitesh.srivastava](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Post date:** [October 31, 2024, 10:08pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/8 "2024-10-31T22:08:07Z")
Thank you @Badger. I will read the documentation and see if I can find some info. The CDR data in our case is being sent over syslog to logstash. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [October 31, 2024, 10:47pm UTC](https://discuss.elastic.co/t/avaya-cdr-data-in-elastic/369837/9 "2024-10-31T22:47:25Z")
`system-parameters cdr` shows the field structure. Somewhere in the documentation I have found they use UTF-16, which I cannot find now. You have already tried ASCII-8BIT, UTF-8, ISO-8859-1. Try with ASCII. Try also to copy a file from /var/home/ftp/CDR and open in an editor. Notepad++ will show you the encoding in own menu.