# ESET Protect CLOUD logs send to Logstash

**URL:** <https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803>\
**Category:** Logstash\
**Tags:** elastic-stack-alerting\
**Created:** [October 30, 2024, 10:00am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803 "2024-10-30T10:00:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roverboy](https://avatars.discourse-cdn.com/v4/letter/r/45deac/32.png) [@Roverboy](https://discuss.elastic.co/u/Roverboy)\
**Post date:** [October 30, 2024, 10:00am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/1 "2024-10-30T10:00:15Z")

</div>

Hi All,

I have a problem with the logs received by my ESET POTECT CLOUD Console.

This is what i received :

"\u0000\u0000\u0011\u0000\u000F\u0000\u0000\f82.64.237.88\u0000\v\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n"

Here my input config :

input {

syslog {  
port =\> 6514  
syslog\_field =\> "syslog"  
codec =\> plain {  
charset =\> "UTF-8"  
}

}

Thank's

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 30, 2024, 12:54pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/2 "2024-10-30T12:54:51Z")

</div>

Hello and welcome,

This seems to be using a different charset, you need to check with ESET which charset is being used to send the logs.

This is not an issue on Logstash side, but on the sender side.

---

<div class="post-metadata">

**Author:** ![Roverboy](https://avatars.discourse-cdn.com/v4/letter/r/45deac/32.png) [@Roverboy](https://discuss.elastic.co/u/Roverboy)\
**Post date:** [October 30, 2024, 1:35pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/3 "2024-10-30T13:35:29Z")

</div>

Hi ,

Thanks for you message, on the Eset Console side I have this :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/25475729429387e72e5e05b4d0ff909f67f6ef11.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 30, 2024, 1:48pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/4 "2024-10-30T13:48:23Z")

</div>

Look at the last line of that image. It expects a TLS-enabled syslog server. logstash [does not do TLS](https://github.com/logstash-plugins/logstash-input-syslog/issues/27) for syslog. What do you get with a tcp input?

---

<div class="post-metadata">

**Author:** ![Roverboy](https://avatars.discourse-cdn.com/v4/letter/r/45deac/32.png) [@Roverboy](https://discuss.elastic.co/u/Roverboy)\
**Post date:** [October 30, 2024, 2:44pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/5 "2024-10-30T14:44:17Z")

</div>

With Tcp input i get the same logs :

"u0000\u0000\u0011\u0000\u000F\u0000\u0000\f82.64.237.88\u0000\v\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n"

---

<div class="post-metadata">

**Author:** ![Sakull](https://avatars.discourse-cdn.com/v4/letter/s/6f9a4e/32.png) [@Sakull](https://discuss.elastic.co/u/Sakull)\
**Post date:** [November 20, 2024, 7:13am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/6 "2024-11-20T07:13:43Z")

</div>

Did you try set connect with certificate signed CA ?

---

<div class="post-metadata">

**Author:** ![Roverboy](https://avatars.discourse-cdn.com/v4/letter/r/45deac/32.png) [@Roverboy](https://discuss.elastic.co/u/Roverboy)\
**Post date:** [November 26, 2024, 3:25pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/7 "2024-11-26T15:25:36Z")

</div>

yeah i try it but i have the same issue

---

<div class="post-metadata">

**Author:** ![Sakull](https://avatars.discourse-cdn.com/v4/letter/s/6f9a4e/32.png) [@Sakull](https://discuss.elastic.co/u/Sakull)\
**Post date:** [December 6, 2024, 9:55am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs-send-to-logstash/369803/8 "2024-12-06T09:55:04Z")

</div>

How looks input.conf on logstash ?