Chinese Characters in Grok

Elastic Stack Logstash
1

I have a log that is in Chinese. An example will be

2016-01-20T17:27:22+08:00 Server1 日志类型:电脑操作, 用户:user12

I have created a grok pattern for parsing this log. I verified it in https://grokdebug.herokuapp.com/

The problem now is that I got this error when I am running Logstash
"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after"

Once I remove the Chinese characters in the grok pattern Logstash will be able to run

How should I resolve this?

2

Is your configuration file UTF-8? No byte order marks at the beginning of the file? It would help if you posted your configuration (format it as code when you paste it) and the output of hexdump -C your-file.conf | head.

3

I have saved it in UTF-8 format.

I am running it on Windows

4

Make sure there is no byte order mark at the beginning of the file. You can use any hex editor for that.

5

So I'll need to hex the log file as well?

6

No! I'm just suggesting that you check that there's no byte order mark at the beginning of the configuration file.

7

Problem solve. Thanks for your advise:relaxed: