Characters coming in non-readable format in ES after sending from filebeat>logstash>ES

Hi Team,

Im tring to get .log files from linux servers to ES using filebeat, logstash and then to ES however when it reaches ES, below is the outcome

Y\xD9\xE7IU\xC8JC\xD5\u000FW\x8EC'\x95j\x8A\x86\xC4kRm\xABFݯ\x87C\u0005\xFF\u0015r\x91\b\xA6\x9E\u0016\u0016\xB6I\xF2]O'e\u0015\xBCd>\xDC9\xF1\x9E\xDF\u0006\\.\u0017\u007F\xD7rC\x89\x9A=b\xB2\xD07yQ\xFB\xB1Ƕ\x85~\x90\xB2s\x96Up\u001A&\x87u\u0006\xD3 d\xFF\xDEV@VfO\x91\xBAP%-\xD4d\x8Fۭ3\xDFH\xDDB\x95X\u0012\x8F:h\u001A\x96\xFC}\xCB\r%*\xF4\u0004\xF6a8o\xBBn'\u0002\u001Fú\x88\xEBw\u0018\xBAN\xB6d\xA92\x90(\xEBh\xF0\u0000\xE8\xB2\xE8\xDB\xE5I\x9C\x9Ak\xAE\u0016}\u0005\xC8\xF40O\xA5F\xB9\x98\x8E\"\x8B\x9A\xDD\xF0\xC28\u000F^\x89\xEEg\xA2\e-c\x98\x898d\x95\x87\xAE\xA9\xC3=\xA5>\u0013\xBAm\xF1p}\u0014_\xDFl\xB9\xA1D\u0005\xBEV\x

The actual logs in the log file looks like the below

2021-09-20 04:00:41,214 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-101) ----- setDisplayName on typeDefinition took: 3301
2021-09-20 04:00:36,785 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-100) ------------- SealCmisService.getTypeDefinition(), timeStart: 1632103236785, timeEnd: 1632103236785, took: 0 ms.
2021-09-20 04:00:36,379 INFO  [ro.star.seal.session.archive.impl.AuditServiceBean] (Thread-603 (ActiveMQ-client-global-threads)) createAudit - userId: 500
2021-09-20 04:00:41,214 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-100) ----- setDisplayName on typeDefinition took: 4429
2021-09-20 04:00:36,113 INFO  [ro.star.seal.cmis.service.SealCmisService] (default task-98) ------------- SealCmisService.getTypeDefinition(), timeStart:

below is my logstash config file

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://*.*.*.*:9200"]
    index => "aem.34-%{+yyyy.MM}" 
  }
stdout { codec => rubydebug }
}

Any idea if I should add any encoding in logstash ?

Just an update

the AEM logs are flowing through private link VPC tunnel to logstash

Can someone help pls

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.