Picking the right charset for Filebeat

Elastic Stack Logstash
1

Hi,

In the beginning I received the following error from Logstash when attempting to send in Linux security logs:

"Received an event that has a different character encoding than you configured".

After checking the logs characterset I determined it was US-ASCII.
I changed my conf as follows:

input{

    syslog {
            type => "syslog"
            port => 55556
            codec => plain { charset => "US-ASCII" }
            add_field => { "data_source" => "linux_security" }
    }

}

output{
if [data_source] == "linux_security" {

            elasticsearch {
                    hosts => ["localhost:9200"]
                    index => "lnx_sec-%{+YYYY.ww}"
                    user => elastic
                    password => password
            }
    }

}

Now only a part of the message appears as gibberish on Kibana:

Capture
Capture1413×269 79.2 KB

What am I missing?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.