# Issues with encoding **URL:** \ **Category:** Beats\ **Created:** [November 20, 2015, 2:25pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160 "2015-11-20T14:25:43Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![vinod8427](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Post date:** [November 23, 2015, 1:47pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/21 "2015-11-23T13:47:40Z")
Currently trying with LS 2.0.0. I havent been using elasticsearch as of now but would be using 2.0.0 rc1 going ahead. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 23, 2015, 1:50pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/22 "2015-11-23T13:50:38Z")
ES 2.0.0 is out and 2.0.1 or 2.1.0 is probably coming soon. So I would go directly with that: [https://www.elastic.co/downloads/elasticsearch](https://www.elastic.co/downloads/elasticsearch) Where did you see the output above? file, stdout? So far I always checked what ends up in elasticsearch. ---
**Author:** ![vinod8427](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Post date:** [November 23, 2015, 1:52pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/23 "2015-11-23T13:52:38Z")
I checked with logstash stdout plugin enabled. I also enabled debug in filebeat and the debug logs also shows the same output. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 23, 2015, 1:53pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/24 "2015-11-23T13:53:18Z")
Ok, good to know. That means I can test filebeat standalone. Thanks for all the infos. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 23, 2015, 10:14pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/25 "2015-11-23T22:14:24Z")
@vinod8427 I can not tell from the conversation if you have really tried with most recent filebeat nightlies. We've not been able to reproduce your problem yet with recent builds, but with rc2 it will definitely fail. From sample log file you send it seems your file is ASCII only. The "plain" codec should be enough here. I have had another look at the lines posted by you. The end of the original line is the start of the line being reported. For comparison the last 'few' bytes from log file (first) and from faulty report (second): ``` 0,,,1,1,,,2,0x1C4C8168,0,,,,,,0,,,,1,,,,,,,6,,,,"sipp",2,1,1,1,1,,0,,,1,7,1,,,10.54.24.102,10.54.80.140,60121,16,8,,,,,,,,,0,,,TANDEM,,,,,,,13,1,,,,,,,,,,,,,,,,0,,,,,,,,0,,,"2,1,0,3",0,,,,,,,,,,,,,,,,,,,,,,,,,, 0,,,1,1,,,2,0x1C4C8168,0,,,,,,0,,,,1,,,,,,,6,,,,"sipp",2,1,1,1,1,,0,,,1,7,1,,,10.54.24.102,10.54.80.140,60121,16,8,,,,,,,,,0,,,TANDEM,,,,,,,13,1,,,,,,,,,,,,,,,,0,,,,,,,,0,,,"2,1,0,3",0,,,,,,,,,,,,,,,,,,,,,,,,,,\n ``` These strings are exactly the same up to '\n'. This, plus the 'restitching' is a strong indicator for issue [#258](https://github.com/elastic/filebeat/issues/258) in filebeat, which has already been resolved before you reported the issue. The most recent nightly you can download from [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/) . Look for filebeat-nightly.latest-\. . Can you retry with nightly please? ---
**Author:** ![vinod8427](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Post date:** [November 24, 2015, 6:57am UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/26 "2015-11-24T06:57:35Z")
@steffens I just tried with latest nightlies and seems to be working fine. I had earlier tried with rc2 and one of the latest nightlies which Nicolas had shared with me. I shall however test this thoroughly and keep you posted if I come across any further issues. Sorry for the trouble. ---
**Author:** ![vinod8427](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Post date:** [November 24, 2015, 6:58am UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/27 "2015-11-24T06:58:42Z")
BTW thanks to both you folks for helping me through this 👍 ---
**Author:** ![vinod8427](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Post date:** [November 24, 2015, 10:13am UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/28 "2015-11-24T10:13:35Z")
@ruflin With the latest nightly I however see that the encoding issue is not an issue anymore but I am facing issue with file reads. After some point of time, filebeat starts to ignore any further changes to both existing files & newly created ones. I am constantly seeing the following in my debug logs: > 2015-11-24T15:42:19+05:30 DBG Not harvesting, file didn't change: /var/log/sonus/sbx/evlog/10054C4.ACT > 2015-11-24T15:42:19+05:30 DBG Check file for harvesting: /var/log/sonus/sbx/evlog/10054C5.ACT > 2015-11-24T15:42:19+05:30 DBG Not harvesting, file didn't change: /var/log/sonus/sbx/evlog/10054C5.ACT However when I restart filebeat, it works fine again but only until some point. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 24, 2015, 10:30am UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/29 "2015-11-24T10:30:00Z")
Good to hear that the first issue is solved. To solve the second issue, you must increase the ignore\_older setting to probably about 20 minutes in your case. Or how long does it take until a file is guaranteed not to update anymore? I know in your case this is a little bit an issue because of the growing registrar file. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/issues-with-encoding/35160/30 "2017-07-05T21:58:01Z")
[Previous page](https://discuss.elastic.co/t/issues-with-encoding/35160.md?page=1)