# Characters coming in non-readable format in ES after sending from filebeat\>logstash\>ES

**URL:** <https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 20, 2021, 5:53pm UTC](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645 "2021-09-20T17:53:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shaiju\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaiju_sam/32/86283_2.png) [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\
**Post date:** [September 20, 2021, 5:53pm UTC](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645/1 "2021-09-20T17:53:11Z")

</div>

Hi Team,

Im tring to get .log files from linux servers to ES using filebeat, logstash and then to ES however when it reaches ES, below is the outcome

```auto
Y\xD9\xE7IU\xC8JC\xD5\u000FW\x8EC'\x95j\x8A\x86\xC4kRm\xABFݯ\x87C\u0005\xFF\u0015r\x91\b\xA6\x9E\u0016\u0016\xB6I\xF2]O'e\u0015\xBCd>\xDC9\xF1\x9E\xDF\u0006\\.\u0017\u007F\xD7rC\x89\x9A=b\xB2\xD07yQ\xFB\xB1Ƕ\x85~\x90\xB2s\x96Up\u001A&\x87u\u0006\xD3 d\xFF\xDEV@VfO\x91\xBAP%-\xD4d\x8Fۭ3\xDFH\xDDB\x95X\u0012\x8F:h\u001A\x96\xFC}\xCB\r%*\xF4\u0004\xF6a8o\xBBn'\u0002\u001Fú\x88\xEBw\u0018\xBAN\xB6d\xA92\x90(\xEBh\xF0\u0000\xE8\xB2\xE8\xDB\xE5I\x9C\x9Ak\xAE\u0016}\u0005\xC8\xF40O\xA5F\xB9\x98\x8E\"\x8B\x9A\xDD\xF0\xC28\u000F^\x89\xEEg\xA2\e-c\x98\x898d\x95\x87\xAE\xA9\xC3=\xA5>\u0013\xBAm\xF1p}\u0014_\xDFl\xB9\xA1D\u0005\xBEV\x

```

The actual logs in the log file looks like the below

```auto
2021-09-20 04:00:41,214 INFO [ro.star.seal.cmis.service.SealCmisService] (default task-101) ----- setDisplayName on typeDefinition took: 3301
2021-09-20 04:00:36,785 INFO [ro.star.seal.cmis.service.SealCmisService] (default task-100) ------------- SealCmisService.getTypeDefinition(), timeStart: 1632103236785, timeEnd: 1632103236785, took: 0 ms.
2021-09-20 04:00:36,379 INFO [ro.star.seal.session.archive.impl.AuditServiceBean] (Thread-603 (ActiveMQ-client-global-threads)) createAudit - userId: 500
2021-09-20 04:00:41,214 INFO [ro.star.seal.cmis.service.SealCmisService] (default task-100) ----- setDisplayName on typeDefinition took: 4429
2021-09-20 04:00:36,113 INFO [ro.star.seal.cmis.service.SealCmisService] (default task-98) ------------- SealCmisService.getTypeDefinition(), timeStart:

```

below is my logstash config file

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://*.*.*.*:9200"]
    index => "aem.34-%{+yyyy.MM}" 
  }
stdout { codec => rubydebug }
}

```

Any idea if I should add any encoding in logstash ?

---

<div class="post-metadata">

**Author:** ![Shaiju\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaiju_sam/32/86283_2.png) [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\
**Post date:** [September 24, 2021, 12:51pm UTC](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645/2 "2021-09-24T12:51:01Z")

</div>

Just an update

the AEM logs are flowing through private link VPC tunnel to logstash

Can someone help pls

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2021, 2:51pm UTC](https://discuss.elastic.co/t/characters-coming-in-non-readable-format-in-es-after-sending-from-filebeat-logstash-es/284645/3 "2021-10-22T14:51:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.