# Encoding charset logstash accents log problem **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2018, 7:35am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087 "2018-05-24T07:35:59Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 24, 2018, 7:36am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/1 "2018-05-24T07:36:00Z")
Hello ELK community 🙂 I've got a problem, I listen a "Vega" log file thanks toFilebeat and then I transfer these logs into Logstash to grok them etc... For exemple, a log line in my log file looks like : > 24/05/2018 09:20:03.276 (EXTERNE) 27/02/2018/D T XX\_ARCXXX\_X\_TN\_ARC011\_PASSAGE\_BATCH(922)/SAU\_XXXXXX\_X\_LL\_OPE001\_EFLUID DEB STATUS : EC La tâche est en exécution sur l'agent XX\_XXXXXX\_X\_AG\_LIN001\_LVBATMLD2 (20920) : LANPRO N° 632415, ATTENTE DE 6 seconde(s) According to Notepad++, this .vld log file is encoding in "ANSI" : ![Sans%20titre](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a840901e63c3970d3bee30bc13384c71b91bd667.png) So that's why my logstash pipeline looks like : ``` ### INPUT SECTION ### input { beats { port => 5044 codec => plain { charset => 'ANSI_X3.4-1968' } } } ### FILTER SECTION ### filter { } ### OUTPUT SECTION ### output { elasticsearch { hosts => "http://localhost:9200" index => "vega" codec => plain { charset => 'ANSI_X3.4-1968' } } } ``` So, I decide to put charset 'ANSI\_X3.4-1968' (see [Plain Codec Plugin)](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-plain.html) But into Kibana, my logs looks like : 24/05/2018 09:20:03.276 (EXTERNE) 27/02/2018/D T XX\_ARCXXX\_X\_TN\_ARC011\_PASSAGE\_BATCH(922)/SAU\_XXXXXX\_X\_LL\_OPE001\_EFLUID DEB STATUS : EC La t�che est en ex�cution sur l'agent XX\_XXXXXX\_X\_AG\_LIN001\_LVBATMLD2 (20920) : LANPRO N� 632415, ATTENTE DE 6 seconde(s) problem of accents ... Does anyone know where this problem comes from? Thank you all 🙂 ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 25, 2018, 7:05am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/2 "2018-05-25T07:05:11Z")
Nobody can help me ? ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 27, 2018, 8:05pm UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/3 "2018-05-27T20:05:42Z")
"ANSI encoding" is a misnomer. Try Windows-1252 instead. See [https://stackoverflow.com/questions/701882/what-is-ansi-format](https://stackoverflow.com/questions/701882/what-is-ansi-format). ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 28, 2018, 6:28am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/4 "2018-05-28T06:28:36Z")
Have I to put "Windows-1252" in Input ? Output ? Or both ? Thx for responses @magnusbaeck. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 6:30am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/5 "2018-05-28T06:30:50Z")
Set the _input's_ codec's charset to Windows-1252. The codec for the elasticsearch output should never be changed. ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 28, 2018, 6:58am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/6 "2018-05-28T06:58:20Z")
I putted in input : ``` input { beats { port => 5044 codec => plain { charset => 'Windows-1252' } } } ``` Result : 28/05/2018 08:53:45.373 (TACHE) 27/02/2018/D T XX\_CACXXX\_X\_TN\_CAC001MT\_PORTEFEUILLE(945)/SAU\_XXXXXX\_X\_LL\_OPE001\_EFLUID TER STATUS : TN Terminaison normale de la **t�che** (TN EXIT CODE 0) It does not seem to work ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 7:18am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/7 "2018-05-28T07:18:42Z")
Oh, right. You're using Filebeat. Probably better to apply the codec on the Filebeat side. Remove the codec setting for the beats input and change the prospector's `encoding` option ([https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#\_literal\_encoding\_literal](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-input-log.html#_literal_encoding_literal)). ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 28, 2018, 7:52am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/8 "2018-05-28T07:52:31Z")
@magnusbaeck, I just add the line "encoding: Windows-1252" into my "filebeat.yml" file And I removed the codec part into my input section. So now : 28/05/2018 09:49:10.670 (TACHE) 11/01/2018/D T XX\_ARCXXX\_X\_TN\_ARC011\_PASSAGE\_BATCH(922)/CLO\_XXXXXX\_X\_LL\_OPE001\_EFLUID TER STATUS : TA Terminaison anormale de la **t�che** (TA EXIT CODE 252) ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 7:55am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/9 "2018-05-28T07:55:46Z")
Okay, so maybe the source data isn't Windows-1252. I don't have any great suggestions then. ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 28, 2018, 8:07am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/10 "2018-05-28T08:07:15Z")
Okay, so how could I find the correct codec of my input's data ? ---
**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\ **Post date:** [May 28, 2018, 8:42am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/11 "2018-05-28T08:42:49Z")
Rectification, it works! I just forgot to restart the Filebeat service after adding the encoding line. thank you for everything @magnusbaeck ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2018, 8:42am UTC](https://discuss.elastic.co/t/encoding-charset-logstash-accents-log-problem/133087/12 "2018-06-25T08:42:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.