# LogStash encoding Issue from Filebeat IIS Access Logs 7.4.0 Stack **URL:** \ **Category:** Logstash\ **Created:** [October 15, 2019, 11:00pm UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721 "2019-10-15T23:00:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [October 15, 2019, 11:00pm UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/1 "2019-10-15T23:00:34Z")
I have tried many ways to get this warning message to go away in my LogStash pipeline but am failing to do so: [2019-10-15T17:42:15,175][WARN][logstash.filters.urldecode] Received an event that has a different character encoding than you configured. {:text=\>"action=savesΓÇ¥, 1, ΓÇ£runMode=1&siteMode=1&siteHel p=\xB1\xBE\xCD\xF8╒╛\xD2\xF2\xB3\xCC\xD0\xF2\xC9\xFD\xBC\xB6\xB9╪▒\xD5\xD6\xD0&SwitchComments=1", :expected\_charset=\>"UTF-8"} I have tried this in the Filebeat Config: - type: log encoding: utf-8 With this in the in LogStash inside of the input/beats: codec =\> plain { charset =\> "UTF-8" } With ingesting many web logs, we are bound to get some special characters of sorts. How can these special characters be properly dealt with? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 15, 2019, 11:09pm UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/2 "2019-10-15T23:09:01Z")
> [@Nicholas\_Penning](#): > > p=\xB1\xBE I do not believe a UTF-8 string can contain two consecutive characters that both start with hex B. You have an input that expects UTF-8, and you are looking at solutions to tell it that the string is UTF-8. The problem is that the string is _not_ UTF-8. I suggest you Google something like "find string encoding" and recommend you also read [this](http://kunststube.net/encoding/). ---
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [October 15, 2019, 11:19pm UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/3 "2019-10-15T23:19:41Z")
Thanks for the quick response, I will dig deeper on this. I was secretly hoping the the Filebeat encoding setting would do some magical work to encoding the incoming data appropriately. Maybe it's worth looking at the source and seeing if I can force an encoding when the logs get written to IIS instead. If any others have gone down this path, please let me know! Thanks Badger! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 15, 2019, 11:49pm UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/4 "2019-10-15T23:49:37Z")
logstash will never guess the encoding. You have to tell it. Adding a front-end (a codec?) to some inputs that could guess the encoding is an interesting idea, but my gut response is that that would be a catastrophe for too many folks. ---
**Author:** ![TechGeekNZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeeknz/32/54697_2.png) [@TechGeekNZ](https://discuss.elastic.co/u/TechGeekNZ)\ **Post date:** [October 16, 2019, 1:32am UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/5 "2019-10-16T01:32:22Z")
Hey Nicholas, Check your logging configuration in IIS. I wonder if you're logging is currently set to ANSI instead of UTF-8 ![logencoding](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08d09a3946ee474f135114d9d14316450c5ddb89.png) Hope this helps ---
**Author:** ![Nicholas\_Penning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicholas_penning/32/55736_2.png) [@Nicholas\_Penning](https://discuss.elastic.co/u/Nicholas_Penning)\ **Post date:** [October 16, 2019, 3:24am UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/6 "2019-10-16T03:24:05Z")
Very good suggestion, I will check this! Thank you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 13, 2019, 3:24am UTC](https://discuss.elastic.co/t/logstash-encoding-issue-from-filebeat-iis-access-logs-7-4-0-stack/203721/7 "2019-11-13T03:24:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.