Chinese Characters in Grok

gringo · January 28, 2016, 2:55am

I have a log that is in Chinese. An example will be

2016-01-20T17:27:22+08:00 Server1 日志类型:电脑操作, 用户:user12

I have created a grok pattern for parsing this log. I verified it in https://grokdebug.herokuapp.com/

The problem now is that I got this error when I am running Logstash
"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after"

Once I remove the Chinese characters in the grok pattern Logstash will be able to run

How should I resolve this?

magnusbaeck · January 28, 2016, 7:00am

Is your configuration file UTF-8? No byte order marks at the beginning of the file? It would help if you posted your configuration (format it as code when you paste it) and the output of hexdump -C your-file.conf | head.

gringo · January 28, 2016, 7:35am

I have saved it in UTF-8 format.

I am running it on Windows

magnusbaeck · January 28, 2016, 8:23am

Make sure there is no byte order mark at the beginning of the file. You can use any hex editor for that.

gringo · January 28, 2016, 8:29am

So I'll need to hex the log file as well?

magnusbaeck · January 28, 2016, 8:44am

No! I'm just suggesting that you check that there's no byte order mark at the beginning of the configuration file.

gringo · February 11, 2016, 7:10am

Problem solve. Thanks for your advise:relaxed: