Hello.
I use Filebeat to send logs to Logstash which forwards them to Elasticsearch and then to Kibana.
The logs appearing in Kibana are not presented correctly as certain characters (umlauts) are replaced with a question mark, like shown on the attached screenshot.
Also if I use the Grok Pattern WORD, it won't work, as words with umlauts will contain symbols instead of the actual letter.
For example there is w?hrend instead of während, or ausgef?hrt instead of ausgeführt.
I already looked for solutions, but it seems like people are running in the same issue without having a clear solution, instead they work around effortly to replace those letter (ä, ö, ü).
I have read one post where magnusbaeck wrote
"I don't understand. If you declare a character set for your input plugin that matches the actual input text, won't Logstash do the right thing by reading the characters correctly and converting them to the correct Unicode codepoints?"
I'm not sure where to put the codec. Does it need to be in input or output?
I tried:
codec => plain {charset => "ISO-8859-1"}
Logstash uses UTF-8 by default, this is why I am confused why it doesn't already show the characters.
So how do I configure Logstash, so that the characters are shown in the right way?