# Help with Filebeat for Windows

**URL:** <https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 3, 2016, 9:24pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109 "2016-10-03T21:24:50Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 3, 2016, 9:24pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/1 "2016-10-03T21:24:50Z")

</div>

I am trying to test out filebeat on a Windows server. Currently I am echoing into a test file that filebeat is monitoring and then output to another file to see what the output looks like. I am writing to the test file with the following command:

`echo "Does this work?" >> .\Logtest.log`

In the output file the Message portion looks like:

`"message":"\ufffd\ufffdD\u0000o\u0000e\u0000s\u0000 \u0000t\u0000h\u0000i\u0000s\u0000 \u0000w\u0000o\u0000r\u0000k\u0000?\u0000\r\u0000",`

Thoughts on whats going on?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 3, 2016, 9:32pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/2 "2016-10-03T21:32:54Z")

</div>

You probably need to set the proper file encoding. See [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#\_encoding](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#_encoding)

```auto
filebeat:
  prospectors:
    - paths:
        - c:\programdata\myapp\logs\*
      # Configure the file encoding for reading files with international characters
      # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
      # Some sample encodings:
      # plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
      # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
      encoding: utf-8

```

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 3, 2016, 9:50pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/3 "2016-10-03T21:50:02Z")

</div>

No dice, I tried both plain and utf-8 encoding, with no luck

Plain resulted in  
`"message":"��t\u0000e\u0000s\u0000t\u0000n\u0000o\u0000t\u0000i\u0000c\u0000e\u0000\r\u0000",`

and utf-8 resulted in  
`"message":"\u0000t\u0000e\u0000s\u0000t\u0000n\u0000o\u0000t\u0000i\u0000c\u0000e\u0000\r\u0000",`

I also just tried manually typing in data and saving and it was the same result.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 4, 2016, 8:16am UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/4 "2016-10-04T08:16:15Z")

</div>

What editor are you using to type in the data?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 4, 2016, 1:46pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/5 "2016-10-04T13:46:13Z")

</div>

can you open/show the file in a hex editor? the `\u0000` is the NULL-character for example. It's literaly a byte having value 0 (normally used to indicate end of C-strings).

If I remember correctly `\ufffd` stands for 'invalid.

Given you have NULL-character followed by a character I'd assume this being UTF-16 with some BOM sequence at beginning of file. Normally windows uses little endian based utf-16 encoding. Try encoding like `utf-16le` or `utf-16le-bom` .

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [October 4, 2016, 4:47pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/6 "2016-10-04T16:47:40Z")

</div>

Thanks everyone for the help, I was able to get it working by changing the encoding to utf-16

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2016, 9:24pm UTC](https://discuss.elastic.co/t/help-with-filebeat-for-windows/62109/7 "2016-10-24T21:24:50Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.