Importing IIS logs - encoding problem

[jontj (Jon)]

Hi,

I am a newbie with ELK and am having a problem importing IIS logs.

The IIS server is logging W3C logs with UTF-8 encoding and my filebeat config is as below:-

filebeat.prospectors

• input_type: log
  encoding: utf-8
  document_type: iis-w3c

  paths:

  • c:\inetpub\logs\LogFiles**.log

However the logstash log states:-

{:timestamp=>"2017-01-03T12:28:11.327000+0000", :message=>"Received an event that has a different character encoding than you configured.", :text=>"\xCALf\u0012\xA6\u0004\xD6l{$6\xFD\u0000", :expected_charset=>"UTF-8", :level=>:warn}

Do I need to make any changes to the logstash.conf?

Thanks In Advance

Jon