[LOGSTASH] - Plugin input-udp and message charset

Elastic Stack Logstash
1

Hello,

I have a an issue with the message charset received from the input-udp plugin.
A raw trace taken using tcpdmp command on linux show the message of the UDP packat like this:
Data: 8689630446410580020000001f46e00000000000000000

BUT on Logstash/Elasticsearch/Kibana discover menu, the message is the following:
\x86\x89c\u0004FA\u0005\x80\u0002\u0000\u0000\u0000-F\xA0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000

I see no error message on the logstash-plain.log file.

Configuration tried:

input {

udp{
port => 7979
tags => ["nbiot","udp"]
#codec => json
codec => plain { charset => "UTF-8" }
#codec => plain { charset => "ISO-8859-1" }
#codec => plain { charset => "locale" }
#codec => line { charset => "ISO-8859-1" }
}

}

Question: I don't see the charset value 'raw', how to display the raw data as seen in the wireshark/tcpdump trace ? This is Logstash that interpret the message differently.

2

FYI, same issue as the following post unsolved:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.