# Issue with logstash and NNT syslog parsing

**URL:** <https://discuss.elastic.co/t/issue-with-logstash-and-nnt-syslog-parsing/169462>\
**Category:** Logstash\
**Created:** [February 21, 2019, 4:07pm UTC](https://discuss.elastic.co/t/issue-with-logstash-and-nnt-syslog-parsing/169462 "2019-02-21T16:07:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![blenski](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@blenski](https://discuss.elastic.co/u/blenski)\
**Post date:** [February 21, 2019, 4:07pm UTC](https://discuss.elastic.co/t/issue-with-logstash-and-nnt-syslog-parsing/169462/1 "2019-02-21T16:07:47Z")

</div>

Hello

I am using logstash to collect logs sent by the NNT Change Tracker Generation 7.

It all configures so I can see message incoming when performing a test but messages are unreadable. I get for instance :  
"message" =\> "\u0016\u0003\u0001\u0000[\u0001\u0000\u0000W\u0003\u0001\n��c��\u000390a\�b���}�O�y��r�\t����c\u0000\u0000\f\u00005\u0000/\u0000\n",  
"@timestamp" =\> 2019-02-21T16:03:15.961Z,  
"host" =\> "10.96.96.13",  
"facility\_label" =\> "kernel",  
"tags" =\> [  
[0] "\_grokparsefailure\_sysloginput"

The application support team told me that :  
"  
I've had some more feedback from the development team and Change Tracker uses the following: "ASCII (7-bit) character set"  
"

but I have not been able to find the right character set in logstash config (I used several including "us-ascii")

do you have any issue what I can use to be able to get my file ?

Thanks

Bruno

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2019, 4:07pm UTC](https://discuss.elastic.co/t/issue-with-logstash-and-nnt-syslog-parsing/169462/2 "2019-03-21T16:07:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.