# Importing IIS logs - encoding problem

**URL:** <https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431>\
**Category:** Logstash\
**Created:** [January 3, 2017, 12:30pm UTC](https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431 "2017-01-03T12:30:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jontj](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@jontj](https://discuss.elastic.co/u/jontj)\
**Post date:** [January 3, 2017, 12:30pm UTC](https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431/1 "2017-01-03T12:30:23Z")

</div>

Hi,

I am a newbie with ELK and am having a problem importing IIS logs.

The IIS server is logging W3C logs with UTF-8 encoding and my filebeat config is as below:-

filebeat.prospectors

- input\_type: log  
encoding: utf-8  
document\_type: iis-w3c

However the logstash log states:-

{:timestamp=\>"2017-01-03T12:28:11.327000+0000", :message=\>"Received an event that has a different character encoding than you configured.", :text=\>"\xCALf\u0012\xA6\u0004\xD6l{$6\xFD\u0000", :expected\_charset=\>"UTF-8", :level=\>:warn}

Do I need to make any changes to the logstash.conf?

Thanks In Advance

Jon

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2017, 12:30pm UTC](https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431/2 "2017-01-31T12:30:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.