# National charset convertation

**URL:** <https://discuss.elastic.co/t/national-charset-convertation/62715>\
**Category:** Logstash\
**Created:** [October 11, 2016, 1:05pm UTC](https://discuss.elastic.co/t/national-charset-convertation/62715 "2016-10-11T13:05:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lego](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@Lego](https://discuss.elastic.co/u/Lego)\
**Post date:** [October 11, 2016, 1:05pm UTC](https://discuss.elastic.co/t/national-charset-convertation/62715/1 "2016-10-11T13:05:31Z")

</div>

Hello everyone.

Please help me to read correctly file with national charset.  
The file is Windows-1251 (Russia). I use encoding options in Filebeat. My Filebeat config is posted below:

filebeat:  
prospectors:  
-  
paths:  
- d:\result.txt  
encoding: unicode  
input\_type: log  
document\_type: log1c

registry\_file: /var/lib/filebeat/registry

output:  
logstash:  
hosts: ["xxx.yyy.zzz.nnn:5044"]  
bulk\_max\_size: 1024

shipper:

logging:  
files:  
rotateeverybytes: 10485760 # = 10MB

In Kibana I see:  
message:20161003;15:31:34;smetanin;E;$$\>@\<8@\>20=85

> BG5B0; 55AB@\>:C\<5=B\>2:F8O;3

It's incorrect.

Could you give me the cue where I'm wrong?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2016, 2:03pm UTC](https://discuss.elastic.co/t/national-charset-convertation/62715/2 "2016-10-11T14:03:56Z")

</div>

> encoding: unicode

"unicode" isn't a valid encoding, and it definitely doesn't make sense for Windows-1251 text. Try "windows-1251" instead.

---

<div class="post-metadata">

**Author:** ![Lego](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@Lego](https://discuss.elastic.co/u/Lego)\
**Post date:** [October 11, 2016, 2:06pm UTC](https://discuss.elastic.co/t/national-charset-convertation/62715/3 "2016-10-11T14:06:20Z")

</div>

Thanks for reply. It was a mistake. The correct encoding is Windows-1251 (without ""). Also I tried windows-1251, "windows-1251", "Windows-1251" without luck.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/national-charset-convertation/62715/4 "2017-07-06T04:34:44Z")

</div>