Can I using chinese in condition

Elastic Stack Beats
#1

Using filebeat to put log into elastic. it seemed I can not using chinese as condition.

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:http://10.200.101.2:9200/}'
  pipelines:
    - pipeline: yibo_test_jsondata
      when.contains:
        message: '上报请求信息'
    - pipeline: yibo_test
  username: "aaa123"
  password: "aaa1234"

as condition, when get json data from message with '上报请求信息',

but get error in filebeat log

2021-04-27T08:45:59.076Z        WARN    [elasticsearch] elasticsearch/client.go:408     Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc01a11b137327ac0, ext:4989328401, loc:(*time.Location)(0x637e220)}, Meta:null, Fields:{"agent":{"ephemeral_id":"b96e4b20-adc8-4593-a5ba-1b171d6a7f5e","hostname":"07178bf552e7","id":"ffee6da7-1017-4247-b554-d900a24b5595","name":"07178bf552e7","type":"filebeat","version":"7.12.0"},"ecs":{"version":"1.8.0"},"event":{"dataset":"yibo_event.database"},"fields":{"event":{}},"host":{"name":"07178bf552e7"},"input":{"type":"log"},"log":{"file":{"path":"/logs/2020-01-01.info.log"},"offset":678027},"message":"[2020:01:01 08:10:28][INFO]接口调用失败,参数:{\"ParkCode\":\"510105037\",\"Mac\":\"6C:4B:90:B4:8F:0F\",\"Random\":null,\"Sign\":null} 返回:{\"state\":-1103001,\"total\":0}"}, Private:file.State{Id:"native::23725743-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00046fe10), Source:"/logs/2020-01-01.info.log", Offset:678194, Timestamp:time.Time{wall:0xc01a11b05a5ac40c, ext:1505429557, loc:(*time.Location)(0x637e220)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x16a06af, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [lpn.message] tried to parse field [message] as object, but found a concrete value"}
#2

You probably have to encode the characters and use the ascii versions.

#3

is there any guide, I don't know how to do. thanks

#4

this maybe, Chinese Tool to Convert Unicode to Chinese

image
image1164×478 12.2 KB

#5

Hi legoguy1000,

so just only change chinese to unicode, right?

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:http://10.200.101.2:9200/}'
  pipelines:
    - pipeline: yibo_test_jsondata
      when.contains:
        message: '\u4e0a\u62a5\u8bf7\u6c42\u4fe1\u606f'
    - pipeline: yibo_test
  username: "aaa123"
  password: "aaa1234"
#6

That's my only thought. Otherwise I'm out of ideas.

#7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.