Characters coming in non-readable format in ES after sending from filebeat>logstash>ES

Elastic Stack Beats
1

Hi Team,

Im tring to get .log files from linux servers to ES using filebeat, logstash and then to ES however when it reaches ES, below is the outcome

Y\xD9\xE7IU\xC8JC\xD5\u000FW\x8EC'\x95j\x8A\x86\xC4kRm\xABFݯ\x87C\u0005\xFF\u0015r\x91\b\xA6\x9E\u0016\u0016\xB6I\xF2]O'e\u0015\xBCd>\xDC9\xF1\x9E\xDF\u0006\\.\u0017\u007F\xD7rC\x89\x9A=b\xB2\xD07yQ\xFB\xB1Ƕ\x85~\x90\xB2s\x96Up\u001A&\x87u\u0006\xD3 d\xFF\xDEV@VfO\x91\xBAP%-\xD4d\x8Fۭ3\xDFH\xDDB\x95X\u0012\x8F:h\u001A\x96\xFC}\xCB\r%*\xF4\u0004\xF6a8o\xBBn'\u0002\u001Fú\x88\xEBw\u0018\xBAN\xB6d\xA92\x90(\xEBh\xF0\u0000\xE8\xB2\xE8\xDB\xE5I\x9C\x9Ak\xAE\u0016}\u0005\xC8\xF40O\xA5F\xB9\x98\x8E\"\x8B\x9A\xDD\xF0\xC28\u000F^\x89\xEEg\xA2\e-c\x98\x898d\x95\x87\xAE\xA9\xC3=\xA5>\u0013\xBAm\xF1p}\u0014_\xDFl\xB9\xA1D\u0005\xBEV\x

The actual logs in the log file looks like the below

2021-09-20 04:00:41,214 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-101) ----- setDisplayName on typeDefinition took: 3301
2021-09-20 04:00:36,785 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-100) ------------- SealCmisService.getTypeDefinition(), timeStart: 1632103236785, timeEnd: 1632103236785, took: 0 ms.
2021-09-20 04:00:36,379 INFO  [ro.star.seal.session.archive.impl.AuditServiceBean] (Thread-603 (ActiveMQ-client-global-threads)) createAudit - userId: 500
2021-09-20 04:00:41,214 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-100) ----- setDisplayName on typeDefinition took: 4429
2021-09-20 04:00:36,113 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-98) ------------- SealCmisService.getTypeDefinition(), timeStart:

below is my logstash config file

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://*.*.*.*:9200"]
    index => "aem.34-%{+yyyy.MM}" 
  }
stdout { codec => rubydebug }
}

Any idea if I should add any encoding in logstash ?

2

Just an update

the AEM logs are flowing through private link VPC tunnel to logstash

Can someone help pls

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.