# ESET Protect Cloud logs

**URL:** <https://discuss.elastic.co/t/eset-protect-cloud-logs/330925>\
**Category:** Logstash\
**Created:** [April 27, 2023, 8:56am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs/330925 "2023-04-27T08:56:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodmontgt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rodmontgt/32/120314_2.png) [@rodmontgt](https://discuss.elastic.co/u/rodmontgt)\
**Post date:** [April 27, 2023, 8:56am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs/330925/1 "2023-04-27T08:56:14Z")

</div>

Hi everyone,

I've been playing around with logtash for days but still have not found a solution for this, my ESET console is configured to send syslog/BSD logs but I am getting this odd character set in my logstash instance, could you give some light on what I need to read or do in order to get readable logs? Thanks in advance

```auto
2023-04-27T14:27:57.000Z {hostname=Application, ip=190.14.138.14} [916] svchost (2796,G,0) The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.
2023-04-27T08:47:58.473535200Z {ip=40.81.8.150} \u0016\u0003\u0001\u0000\xC9\u0001\u0000\u0000\xC5\u0003\u0003\x8EQ\xB7\xCDL\xD3r\x90nΏ\xFE\xA1\u0016\xBB\u001A\x80`&\u0016!\xD9S~8\xB7\u0003\x84}\x88(\xA8\u0000\u00008\xC0,\xC00\u0000\x9F̨̩̪\xC0+\xC0/\u0000\x9E\xC0$\xC0(\u0000k\xC0#\xC0'\u0000g\xC0\n
2023-04-27T08:47:58.495544700Z {ip=40.81.8.150} \xC0\u0014\u00009\xC0\t\xC0\u0013\u00003\u0000\x9D\u0000\x9C\u0000=\u0000<\u00005\u0000/\u0000\xFF\u0001\u0000\u0000d\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\r54.91.253.102\u0000\v\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n
2023-04-27T08:47:58.498536800Z {ip=40.81.8.150} 

```

This is my custom conf

```auto
input {
   syslog {
      port => 6514

   }
}

output {
   file {
      path => "C:\logstash\logs\file_name.log"
      codec => "line"
   }
}

```

---

<div class="post-metadata">

**Author:** ![rodmontgt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rodmontgt/32/120314_2.png) [@rodmontgt](https://discuss.elastic.co/u/rodmontgt)\
**Post date:** [April 27, 2023, 9:26am UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs/330925/2 "2023-04-27T09:26:37Z")

</div>

I want to add an screen of the console in Windows with the error, I already tried to change the encoding to ISO-8859-1 but no luck

```auto
input {
   syslog {
      port => 6514
      codec => plain {
                    charset => "ISO-8859-1"
            }

   }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/114948578ba43bb3357da6fbe67beadf365ce37f.jpeg)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 27, 2023, 1:50pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs/330925/3 "2023-04-27T13:50:24Z")

</div>

> [@rodmontgt](#):
>
> ```auto
> 2023-04-27T08:47:58.473535200Z {ip=40.81.8.150} \u0016\u0003\u0001\u0000\xC9\u0001\u0000\u0000\xC5\u0003\u0003\x8EQ\xB7\xCDL\xD3r\x90nΏ\xFE\xA1\u0016\xBB\u001A\x80`&\u0016!\xD9S~8\xB7\u0003\x84}\x88(\xA8\u0000\u00008\xC0,\xC00\u0000\x9F̨̩̪\xC0+\xC0/\u0000\x9E\xC0$\xC0(\u0000k\xC0#\xC0'\u0000g\xC0\n
> 2023-04-27T08:47:58.495544700Z {ip=40.81.8.150} \xC0\u0014\u00009\xC0\t\xC0\u0013\u00003\u0000\x9D\u0000\x9C\u0000=\u0000<\u00005\u0000/\u0000\xFF\u0001\u0000\u0000d\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\r54.91.253.102\u0000\v\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n
> 
> ```

Is this your original message? Before logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2023, 1:50pm UTC](https://discuss.elastic.co/t/eset-protect-cloud-logs/330925/4 "2023-05-25T13:50:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.