Logstash and codec => "Windows-1251" bug?


(Ilya) #1

Good time of the day.
Try to configure ELK for some system, where parsing logs throw filebeat and recive some problem. I am new in ELK, so may be I am just make some stupid mistake.

I have some logs in Windows-1251 encoding. I configured filebeat with encoding

[spoiler] paths:
- C:\DIS-DAS_Logs*.txt
document_type: DAS_log
encoding: Windows-1251
scan_frequency: 10s

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["127.0.0.1:5044"]
[/spoiler]

And input in Logstash

beats {
port => 5044
codec => plain {charset => "Windows-1251"}
}

But message from Logstash in bad encoding.
I try to send log from filebeat directly to Elasticsearch

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["127.0.0.1:9200"]

And everything work normal. My Logstash configuration is bad or something else?


(Ilya) #2

Solved.
Set

encoding: CP1251
in filebeat.yml, and everything works OK. Bad communication with logstash in 'Windows-1251' name?


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.