Good time of the day.
Try to configure ELK for some system, where parsing logs throw filebeat and recive some problem. I am new in ELK, so may be I am just make some stupid mistake.
I have some logs in Windows-1251 encoding. I configured filebeat with encoding
[spoiler] paths:
- C:\DIS-DAS_Logs*.txt
document_type: DAS_log
encoding: Windows-1251
scan_frequency: 10s
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["127.0.0.1:5044"]
[/spoiler]
And input in Logstash
beats {
port => 5044
codec => plain {charset => "Windows-1251"}
}
But message from Logstash in bad encoding.
I try to send log from filebeat directly to Elasticsearch
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["127.0.0.1:9200"]
And everything work normal. My Logstash configuration is bad or something else?