Log through Filebeat has hex values, but direct to Logstash does not

ELK 6.0.0/Filebeat 6.0.0

Logs are single line json:
{"msg":"Logger in Debug mode","sev":"DEBUG","ts":"2017-11-15T19:38:44:0223Z"}

This works fine:
$ nc localhost 5044 < json-log.log

Same file put in Filebeat log directory has hex values:
@version:1 host:dockerelkmaster_filebeat_1.dockerelkmaster_elk @timestamp:February 1st 2018, 16:54:21.862 @metdata.ip_address:172.18.0.5 message:2W\u0000\u0000\u0000\u00042C\u0.....etc.

filebeat.yml:
filebeat.prospectors:

  • type: log
    encoding: utf-8

    enabled: true
    paths:

    • /tmp/*.log

output.logstash:
hosts: ["logstash:5044"]

Can you share a sample log file which exhibits this behavior?

The line mentioned above is the log file contents:
Logs are single line json:
{"msg":"Logger in Debug mode","sev":"DEBUG","ts":"2017-11-15T19:38:44:0223Z"}

Since log file are all JSON I've removed logstash in filebeat.yml and replaced with elasticsearch:

#output.logstash:
#hosts: ["logstash:5044"]

output.elasticsearch:
hosts: ["elasticsearch:9200"]

This works great, but would still like to figure out issue with Logstash for possible use in the future.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.