I've found this in logstash log:
[2017-09-07T08:50:36,681][ERROR][logstash.outputs.elasticsearch] Encountered an unexpected error submitting a bulk request! Will retry. {:error_message=>"incompatible encodings: Windows-1250 and UTF-8", :class=>"Encoding::CompatibilityError", :backtrace=>["e:/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.8-java/lib/logstash/outputs/elasticsearch/common.rb:153:in `submit'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:971:in `each_with_index'", "e:/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.8-java/lib/logstash/outputs/elasticsearch/common.rb:131:in `submit'", "e:/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.8-java/lib/logstash/outputs/elasticsearch/common.rb:91:in `retrying_submit'", "e:/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.8-java/lib/logstash/outputs/elasticsearch/common.rb:42:in `multi_receive'", "e:/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:13:in `multi_receive'", "e:/logstash/logstash-core/lib/logstash/output_delegator.rb:47:in `multi_receive'", "e:/logstash/logstash-core/lib/logstash/pipeline.rb:420:in `output_batch'", "org/jruby/RubyHash.java:1342:in `each'", "e:/logstash/logstash-core/lib/logstash/pipeline.rb:419:in `output_batch'", "e:/logstash/logstash-core/lib/logstash/pipeline.rb:365:in `worker_loop'", "e:/logstash/logstash-core/lib/logstash/pipeline.rb:330:in `start_workers'"]}
And here's my pipeline:
# The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
beats {
port => "5044"
}
}
# The filter part of this file is commented out to indicate that it is
# optional.
filter {
mutate {
gsub => ["message", "\|C3\|", "|cir=C3|"]
}
# kv {
# field_split => "|"
# }
ruby {
code => "
a = event.get('message').split('|').delete_if{|x| !x.match(/=/)}
a.each {|y| b = y.split('=', 2)
event.set(b[0].strip, b[1])
}
event.set('acronym', event.get('acronym').upcase)"
}
mutate {
gsub => ["date", " ", ";"]
convert => {"type" => "integer"}
convert => {"rptPackageStatus" => "integer"}
add_field => {"country" => "si"}
}
date {
locale => "en"
match => ["date", "dd.MM.YYYY;HH:mm:ss"]
timezone => "Europe/Ljubljana"
target => "date"
}
date {
locale => "en"
match => ["returnDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "returnDate"
}
date {
locale => "en"
match => ["firstsignUpDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "firstsignUpDate"
}
date {
locale => "en"
match => ["lastVisitDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "lastVisitDate"
}
date {
locale => "en"
match => ["loanDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "loanDate"
}
date {
locale => "en"
match => ["lastProlongDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "lastProlongDate"
}
date {
locale => "en"
match => ["reservationDate", "dd.MM.YYYY"]
timezone => "Europe/Ljubljana"
target => "reservationDate"
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "transakcije"
document_type => "log_transakcije"
}
# stdout { codec => rubydebug }
}