# Filebeat error. Returns unicode character code instead of symbol

**URL:** <https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 3, 2016, 9:50am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827 "2016-11-03T09:50:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [November 3, 2016, 9:50am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/1 "2016-11-03T09:50:42Z")

</div>

I have a multiline log file, in which entries are nested using xml like markup, inside `<` and `>` tags. I have defined multiline pattern and it works fine. It was working fine with filebeat 5.0.0 alpha. But in new 5.0 GA version, it is showing some bug. I have enabled `output.file` and in it, under `message`, it is showing `\u003c` and `\u003e`. The encoding i set is utf-8. Why is this happening?

Thanks.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [November 3, 2016, 2:06pm UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/2 "2016-11-03T14:06:04Z")

</div>

@elasticcloud See [https://github.com/elastic/beats/issues/2581](https://github.com/elastic/beats/issues/2581)

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [November 4, 2016, 4:31am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/3 "2016-11-04T04:31:01Z")

</div>

Its not a problem with Filebeat, its a problem with Logstash. Logstash 2.3.4 is handling this perfectly, but issue with Logstash 5. It is showing \_grokparsefailure. It is not taking `\u003c` and `\u003e`equal to `<` and `>`

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [November 8, 2016, 8:08am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/4 "2016-11-08T08:08:21Z")

</div>

@elasticcloud Not sure I can follow. The behaviour changed on the beats side. Before \< was sent, now \u003c is sent to Logstash.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [November 8, 2016, 8:12am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/5 "2016-11-08T08:12:02Z")

</div>

@ruflin Actually I was using Filebeat -\> Kafka -\> Logstash architecture. There is a setting `codec => json` in new logstash, and I dont had that setting (in Logstash 2.3.4 too). I made the setting and everything is fine now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2016, 9:50am UTC](https://discuss.elastic.co/t/filebeat-error-returns-unicode-character-code-instead-of-symbol/64827/6 "2016-11-24T09:50:59Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.