# Logstash input displayed wrong in Kibana

**URL:** <https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650>\
**Category:** Logstash\
**Created:** [November 29, 2017, 10:06pm UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650 "2017-11-29T22:06:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Timshs](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Timshs](https://discuss.elastic.co/u/Timshs)\
**Post date:** [November 29, 2017, 10:06pm UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/1 "2017-11-29T22:06:52Z")

</div>

I get \xC0\t\xC0\b\xC00\xC0/\xC0(\xC0'\xC0\u0014\xC0\u0013\xC0\u0012\u0000\x9D\u0000\x9C\u0000=\u0000\<\u00005\u0000/\u0000 as message in Kibana when sending tcp input to logstash from IOS.

My logstash.conf is:  
input {  
tcp {  
port =\> 5043  
codec =\> json\_lines  
}  
}

filter {  
json {  
source =\> "message"  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

Any help would be lovely 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 30, 2017, 6:23am UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/2 "2017-11-30T06:23:26Z")

</div>

What are you sending, exactly? What program and protocol?

---

<div class="post-metadata">

**Author:** ![Timshs](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Timshs](https://discuss.elastic.co/u/Timshs)\
**Post date:** [November 30, 2017, 7:36am UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/3 "2017-11-30T07:36:08Z")

</div>

We are using [https://github.com/justeat/JustLog](https://github.com/justeat/JustLog) sending over TCP socket ... and it seems to connect fine but the data gets twisted. Not sure if it is SSL related

---

<div class="post-metadata">

**Author:** ![Timshs](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Timshs](https://discuss.elastic.co/u/Timshs)\
**Post date:** [December 1, 2017, 7:35am UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/4 "2017-12-01T07:35:12Z")

</div>

any idea ? have you seen it before ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 1, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/5 "2017-12-01T09:48:33Z")

</div>

I don't know anything about JustLog. You need to figure out how to get it to send data in a format that we at least know what it is. The JustLog documentation didn't offer any details on how it sends the data or how Logstash should be configured so I can't help with that.

---

<div class="post-metadata">

**Author:** ![Timshs](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Timshs](https://discuss.elastic.co/u/Timshs)\
**Post date:** [December 22, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/6 "2017-12-22T15:33:57Z")

</div>

Hi Magnus  
It was the ssl handshake not working. Did not have correctly created certs created. Fixed now 🙂

/Tim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2018, 3:34pm UTC](https://discuss.elastic.co/t/logstash-input-displayed-wrong-in-kibana/109650/7 "2018-01-19T15:34:30Z")

</div>

Closed on January 19, 2018, 3:34pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.