# Expecting UTF-8 Char set

**URL:** <https://discuss.elastic.co/t/expecting-utf-8-char-set/24583>\
**Category:** Logstash\
**Created:** [June 29, 2015, 11:13pm UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583 "2015-06-29T23:13:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rspangle](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@rspangle](https://discuss.elastic.co/u/rspangle)\
**Post date:** [June 29, 2015, 11:13pm UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583/1 "2015-06-29T23:13:35Z")

</div>

I have some log entries that are coming in from snare that look ok in the snare.log file, but when looking at the logstash.log, I see a message that says a character set other than UTF-8 was expected, but no indication on what character set I received. Other servers and workstations on the network don't have this message. Earlier in the day, I wasn't receiving any snare logs, but restarting logstash and elasticsearch made some of the logs start coming in. Any thoughts on how to troubleshoot this would be appreciated!!!

---

<div class="post-metadata">

**Author:** ![MrAV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrav/32/557_2.png) [@MrAV](https://discuss.elastic.co/u/MrAV)\
**Post date:** [July 1, 2015, 8:04am UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583/2 "2015-07-01T08:04:02Z")

</div>

I had a similar issue on some of my servers and I've resolved this issue by adding correct charset name (at first open you log-file in someone application, which is able to show a text encoding) to input section:

```
file {
path => ["C:\App\events.log"]
type => "APP-log"
codec => plain { charset => "Windows-1252" }
```

---

<div class="post-metadata">

**Author:** ![rspangle](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@rspangle](https://discuss.elastic.co/u/rspangle)\
**Post date:** [July 1, 2015, 10:44pm UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583/3 "2015-07-01T22:44:41Z")

</div>

What made you decide to use Windows-1252. I was looking for a way to determine which character set it it receiving

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583/4 "2017-07-06T05:35:47Z")

</div>