Importing IIS logs - encoding problem

Elastic Stack Logstash
1

Hi,

I am a newbie with ELK and am having a problem importing IIS logs.

The IIS server is logging W3C logs with UTF-8 encoding and my filebeat config is as below:-

filebeat.prospectors

  • input_type: log
    encoding: utf-8
    document_type: iis-w3c

    paths:

    • c:\inetpub\logs\LogFiles**.log

However the logstash log states:-

{:timestamp=>"2017-01-03T12:28:11.327000+0000", :message=>"Received an event that has a different character encoding than you configured.", :text=>"\xCALf\u0012\xA6\u0004\xD6l{$6\xFD\u0000", :expected_charset=>"UTF-8", :level=>:warn}

Do I need to make any changes to the logstash.conf?

Thanks In Advance

Jon

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.