Logstash 7.9 high CPU, RAM and hangs when a unicode message is received by syslog input

Elastic Stack Logstash
1

Hi All, any assistance on this issue would be most appreciated.

On receiving the following message, logstash stopped processing any further incoming messages and began consuming high CPU.

  • Version: 7.9.0
  • Operating System: RHEL 7
  • Config File:
    input {
    syslog {
    codec => cef
    port => 514
    }
    }
  • Sample Data:
    [WARN] 21-04-09 20:39:33 [Ruby-0-Thread-136: :1] plain - Received an event that has a different character encoding than you configured. {:text=>",<12>Apr 0:39:48 hostname \xB0\u0014[17693]: remainder of message redacted", :expected_charset=>"UTF-8"
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.