# Does eventlog plugin support on Chinese windows 2012R2?

**URL:** <https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489>\
**Category:** Logstash\
**Created:** [December 7, 2015, 4:56am UTC](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489 "2015-12-07T04:56:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![woodkan](https://avatars.discourse-cdn.com/v4/letter/w/db5fbb/32.png) [@woodkan](https://discuss.elastic.co/u/woodkan)\
**Post date:** [December 7, 2015, 4:56am UTC](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489/1 "2015-12-07T04:56:45Z")

</div>

I am using LS 2.1. My Windows servers are all Chinese Windows 2012R2. I configure LS to use eventlog plugin to collect windows security log. but the output is like below"  
"message" =\> "\xD5\xCA\xBB\xA7\xB5\xC7\xC2\xBC\xCA\xA7\xB0\xDC\xA1\xA3\r\n\r\n\xCA\xB9\xD3\xC3\xD5\xDF:\r"

I tried to set the charset to GB18030, GB2312, GBK, the output are all the same?

Does eventlog not support on chinese Windows server?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2015, 5:29am UTC](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489/2 "2015-12-07T05:29:05Z")

</div>

Please keep it to a single thread, some will answer if they can 😄

> [@How to collect chinese windows 2012 evenglog?](https://discuss.elastic.co/t/how-to-collect-chinese-windows-2012-evenglog/36342):
>
> I am using LS and ES 2.1 . I want to to use LS eventlog plugin to collect my windows server's eventlog. My Windows server was Windows 2012 R2 chinese. I configure eventlog as below: input { eventlog { type =\> 'wineventlog' #logfile =\> ["System","Application","Security"] logfile =\> ['Security'] codec =\> { plain =\> { charset =\> "GB18030" }} } } but the output messages is like " "message" =\> "\xD5\xCA\xBB\xA7\xB5\xC7\xC2\xBC\xCA\xA7\xB0\xDC\xA1\xA3\r\n\r\n\xCA\xB9\xD3\xC3\xD5\xD......" I…

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2015, 5:29am UTC](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489/3 "2015-12-07T05:29:13Z")

</div>