Received an event that has a different character encoding than you configured:)

Elastic Stack Logstash
1

when using logstash I see an error like this one :

[2019-03-14T12:59:39,516][WARN ][logstash.codecs.plain    ] 
Received an event that has a different character encoding than you configured.
{
:text=>"08/02/2019 22:45:06 ||  : Service Reglement, ValiderReglementBilling:Echec de validation de r\\xE9glement dans NaviBilling. Transaction N\\xB0: 20194160773This message is for C/AL programmers: The call to member CreationFacture failed: Input string was not in a correct format..\\r", 
:expected_charset=>"UTF-8"
}

I do not know what codec should be used for the correct format of events ?? The problem is in the subject field.

my logstash.conf is

input {
file {
path => "D:/ELK/log2/*-Error.log"
start_position => "beginning"
}
}
filter {
grok {
match => {"message" => ["%{DATESTAMP:timestamp} || : %{DATA:service} *[,:] *%{DATA:event} *: %{GREEDYDATA:message}"]
}
}
}
filter {
date {
match => ["timestamp","dd/MM/YYYY HH:mm:ss"]
}
}
output {
elasticsearch {
action => "index"
hosts => "http://localhost:9200"
index => "logstash-pfe104"

}
}

`

2

If you want \xE9 to be é then I would suggest adding this to your file input

codec => plain { charset => "ASCII-8BIT" }
3

When I run the pipeline, I see way more events than I expect and the pipeline hangs. When I press Ctrl+C (multiple times) Logstash stalls, and I see the following messages:

[2019-04-03T11:27:53,429][WARN ][logstash.runner ] SIGINT received. Shutting down the agent.
2019-04-03 11:27:58,980 SIGINT handler ERROR Unable to move file D:\ELK\logstash-5.6.3\logs\logstash-plain.log to D:\ELK\logstash-5.6.3\logs\logstash-plain-2019-04-02.log: java.nio.file.FileSystemException D:\ELK\logstash-5.6.3\logs\logstash-plain.log -> D:\ELK\logstash-5.6.3\logs\logstash-plain-2019-04-02.log: Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
[2019-04-03T11:28:01,183][FATAL][logstash.runner ] SIGINT received. Terminating immediately..
data loss.
The signal INT is in use by the JVM and will not work correctly on this platform

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.