Filebeat with MSSQL and utf-16le

Elastic Stack Beats
1

Hello
I am using Stack 7.4.0 on Windows 10 trying to parse my MSSQL logs.
When using the filebeat.input as below it works file. Lines are correctly decoded
and multiline is correctly handled.

filebeat.inputs:
- type: log
  encoding: utf-16le
  enabled: true
  paths: 
    - C:/PathOfMSSQL/MSSQLLOG/ERRORLOG*
  exclude_files: [".gz$"]
  multiline.pattern: '^\d\d'
  multiline.negate: true
  multiline.match: after

But when i declare to use the mssql module, encoding is not taken in account and the whole file is considered as the message.
Here is the sample of the mssql module

filebeat.modules:
- module: mssql
  enabled: true
  log:
    encoding: utf-16le
    enabled: true
    var.paths: ["C:/PathOfMSSQL/MSSQLLOG/ERRORLOG*"]
    exclude_files: [".gz$"]
    multiline.pattern: '^\d\d'
    multiline.negate: true
    multiline.match: after

Any Guess ?

2

hi @Christian_SANCHEZ, can you try:

 module: mssql
  log:
     enabled: true
     var.paths: ["C:/PathOfMSSQL/MSSQLLOG/ERRORLOG*"]

    input:
        encoding: utf-16le
        exclude_files: [".gz$"]
        multiline.pattern: '^\d\d'
        multiline.negate: true
        multiline.match: after

let us know if this worked in your case.

1 Like
3

Hello
IT WORKS
Thank you very much
:smiley:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.