The question-mark-in-black-diamond character is a replacement character that is used when the UTF16 -> UTF8 character conversion fails.
This piece of config codec => plain { charset => "UTF-16" } says to Logstash "Treat all text as UTF16 and convert it to UTF8"
There may be some illegal surrogates http://unicode.org/faq/utf_bom.html#utf16-7
or maybe the charset conversion library we use does not deal with noncharacters http://www.unicode.org/faq/private_use.html#noncharacters very well.