How to set charset in input, filter and output in logstash conf fille

Elastic Stack Logstash
1

Hi,

I have in my logstash-plain.log this kind of log :

[2018-03-07T09:02:28,053][WARN ][logstash.codecs.multiline] Received an event that has a different character encoding than you configured. {:text=>"\\u00002\\u00000\\u00001\\u00008\\u0000-\\u00000\\u00003\\u0000-\\u00000\\u00006\\u0000 \\u00001\\u00002\\u0000:\\u00002\\u00003\\u0000:\\u00001\\u00001\\u0000 \\u0000I\\u0000N\\u0000F\\u0000O\\u0000 \\u0000 \\u0000[\\u0000C\\u0000u\\u0000s\\u0000t\\u0000o\\u0000m\\u0000i\\u0000s\\u0000e\\u0000d\\u0000C\\u0000o\\u0000n\\u0000t\\u0000r\\u0000a\\u0000c\\u0000t\\u0000O\\u0000v\\u0000e\\u0000r\\u0000v\\u0000i\\u0000e\\u0000w\\u0000.\\u0000p\\u0000r\\u0000o\\u0000c\\u0000e\\u0000s\\u0000s\\u0000P\\u0000a\\u0000g\\u0000e\\u0000]\\u0000 \\u0000D\\u0000u\\x88t\\u0000 \\u0000p\\u0000r\\u0000o\\u0000c\\u0000e\\u0000s\\u0000s\\u0000P\\u0000a\\u0000g\\u0000e\\u0000", :expected_charset=>"UTF-8"}

I have different kind of file charset.
This one is in "Little-endian UTF-16 Unicode text"
and I'm using also :

codec => multiline {
    pattern => "^(%{YEAR}.%{MONTHNUM}.%{MONTHDAY}\s*%{HOUR}:?%{MINUTE}(?::?%{SECOND}))"
    negate => true
    what => "previous"
    charset => "UTF-16"
}

Do you have any idea how to set the charset and where ?

Regards

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.