Filebeat error. Returns unicode character code instead of symbol

Elastic Stack Beats
1

I have a multiline log file, in which entries are nested using xml like markup, inside < and > tags. I have defined multiline pattern and it works fine. It was working fine with filebeat 5.0.0 alpha. But in new 5.0 GA version, it is showing some bug. I have enabled output.file and in it, under message, it is showing \u003c and \u003e. The encoding i set is utf-8. Why is this happening?

Thanks.

2

@elasticcloud See https://github.com/elastic/beats/issues/2581

3

Its not a problem with Filebeat, its a problem with Logstash. Logstash 2.3.4 is handling this perfectly, but issue with Logstash 5. It is showing _grokparsefailure. It is not taking \u003c and \u003eequal to < and >

4

@elasticcloud Not sure I can follow. The behaviour changed on the beats side. Before < was sent, now \u003c is sent to Logstash.

5

@ruflin Actually I was using Filebeat -> Kafka -> Logstash architecture. There is a setting codec => json in new logstash, and I dont had that setting (in Logstash 2.3.4 too). I made the setting and everything is fine now.

6

This topic was automatically closed after 21 days. New replies are no longer allowed.