# Can I using chinese in condition

**URL:** <https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 27, 2021, 8:55am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339 "2021-04-27T08:55:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tbs575](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbs575/32/87690_2.png) [@tbs575](https://discuss.elastic.co/u/tbs575)\
**Post date:** [April 27, 2021, 8:55am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/1 "2021-04-27T08:55:53Z")

</div>

Using filebeat to put log into elastic. it seemed I can not using chinese as condition.

```auto
output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:http://10.200.101.2:9200/}'
  pipelines:
    - pipeline: yibo_test_jsondata
      when.contains:
        message: '上报请求信息'
    - pipeline: yibo_test
  username: "aaa123"
  password: "aaa1234"

```

as condition, when get json data from message with '上报请求信息',

but get error in filebeat log

```auto
2021-04-27T08:45:59.076Z WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc01a11b137327ac0, ext:4989328401, loc:(*time.Location)(0x637e220)}, Meta:null, Fields:{"agent":{"ephemeral_id":"b96e4b20-adc8-4593-a5ba-1b171d6a7f5e","hostname":"07178bf552e7","id":"ffee6da7-1017-4247-b554-d900a24b5595","name":"07178bf552e7","type":"filebeat","version":"7.12.0"},"ecs":{"version":"1.8.0"},"event":{"dataset":"yibo_event.database"},"fields":{"event":{}},"host":{"name":"07178bf552e7"},"input":{"type":"log"},"log":{"file":{"path":"/logs/2020-01-01.info.log"},"offset":678027},"message":"[2020:01:01 08:10:28][INFO]接口调用失败,参数:{\"ParkCode\":\"510105037\",\"Mac\":\"6C:4B:90:B4:8F:0F\",\"Random\":null,\"Sign\":null} 返回:{\"state\":-1103001,\"total\":0}"}, Private:file.State{Id:"native::23725743-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00046fe10), Source:"/logs/2020-01-01.info.log", Offset:678194, Timestamp:time.Time{wall:0xc01a11b05a5ac40c, ext:1505429557, loc:(*time.Location)(0x637e220)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x16a06af, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [lpn.message] tried to parse field [message] as object, but found a concrete value"}

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 28, 2021, 1:27am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/2 "2021-04-28T01:27:59Z")

</div>

You probably have to encode the characters and use the ascii versions.

---

<div class="post-metadata">

**Author:** ![tbs575](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbs575/32/87690_2.png) [@tbs575](https://discuss.elastic.co/u/tbs575)\
**Post date:** [April 28, 2021, 3:04am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/3 "2021-04-28T03:04:08Z")

</div>

> [@tbs575](#):
>
> Using filebeat to put log into elastic. it seemed I can not using chinese as condition.

is there any guide, I don't know how to do. thanks

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 28, 2021, 6:37pm UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/4 "2021-04-28T18:37:03Z")

</div>

this maybe, [Chinese Tool to Convert Unicode to Chinese](https://www.chineseconverter.com/en/convert/unicode)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/8474998387e99b6047b754f4ea515894ff37c46b.png)

---

<div class="post-metadata">

**Author:** ![tbs575](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbs575/32/87690_2.png) [@tbs575](https://discuss.elastic.co/u/tbs575)\
**Post date:** [April 29, 2021, 12:54am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/5 "2021-04-29T00:54:06Z")

</div>

> [@tbs575](#):
>
> `上报请求信息`

Hi legoguy1000,

so just only change chinese to unicode, right?

```auto
output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:http://10.200.101.2:9200/}'
  pipelines:
    - pipeline: yibo_test_jsondata
      when.contains:
        message: '\u4e0a\u62a5\u8bf7\u6c42\u4fe1\u606f'
    - pipeline: yibo_test
  username: "aaa123"
  password: "aaa1234"

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 29, 2021, 1:09am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/6 "2021-04-29T01:09:15Z")

</div>

That's my only thought. Otherwise I'm out of ideas.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2021, 3:09am UTC](https://discuss.elastic.co/t/can-i-using-chinese-in-condition/271339/7 "2021-05-27T03:09:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.