# Received an event that has a different character encoding than you configured:)

**URL:** <https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513>\
**Category:** Logstash\
**Created:** [March 22, 2019, 3:04pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513 "2019-03-22T15:04:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nejmeddine\_ammar](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@nejmeddine\_ammar](https://discuss.elastic.co/u/nejmeddine_ammar)\
**Post date:** [March 22, 2019, 3:04pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513/1 "2019-03-22T15:04:35Z")

</div>

when using logstash I see an error like this one :

```auto
[2019-03-14T12:59:39,516][WARN][logstash.codecs.plain] 
Received an event that has a different character encoding than you configured.
{
:text=>"08/02/2019 22:45:06 || : Service Reglement, ValiderReglementBilling:Echec de validation de r\\xE9glement dans NaviBilling. Transaction N\\xB0: 20194160773This message is for C/AL programmers: The call to member CreationFacture failed: Input string was not in a correct format..\\r", 
:expected_charset=>"UTF-8"
}

```

I do not know what codec should be used for the correct format of events ?? The problem is in the subject field.

my logstash.conf is

input {  
file {  
path =\> "D:/ELK/log2/\*-Error.log"  
start\_position =\> "beginning"  
}  
}  
filter {  
grok {  
match =\> {"message" =\> ["%{DATESTAMP:timestamp} || : %{DATA:service} \*[,:] \*%{DATA:event} \*: %{GREEDYDATA:message}"]  
}  
}  
}  
filter {  
date {  
match =\> ["timestamp","dd/MM/YYYY HH:mm:ss"]  
}   
}   
output {  
elasticsearch {  
action =\> "index"  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "logstash-pfe104"

}  
}

`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2019, 4:33pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513/2 "2019-03-22T16:33:42Z")

</div>

> [@nejmeddine\_ammar](#):
>
> I do not know what codec should be used for the correct format of events

If you want \xE9 to be é then I would suggest adding this to your file input

```
codec => plain { charset => "ASCII-8BIT" }

```

---

<div class="post-metadata">

**Author:** ![nejmeddine\_ammar](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@nejmeddine\_ammar](https://discuss.elastic.co/u/nejmeddine_ammar)\
**Post date:** [April 3, 2019, 12:47pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513/3 "2019-04-03T12:47:09Z")

</div>

When I run the pipeline, I see way more events than I expect and the pipeline hangs. When I press Ctrl+C (multiple times) Logstash stalls, and I see the following messages:

[2019-04-03T11:27:53,429][WARN][logstash.runner] SIGINT received. Shutting down the agent.  
2019-04-03 11:27:58,980 SIGINT handler ERROR Unable to move file D:\ELK\logstash-5.6.3\logs\logstash-plain.log to D:\ELK\logstash-5.6.3\logs\logstash-plain-2019-04-02.log: java.nio.file.FileSystemException D:\ELK\logstash-5.6.3\logs\logstash-plain.log -\> D:\ELK\logstash-5.6.3\logs\logstash-plain-2019-04-02.log: Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.  
[2019-04-03T11:28:01,183][FATAL][logstash.runner] SIGINT received. Terminating immediately..  
data loss.  
The signal INT is in use by the JVM and will not work correctly on this platform

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2019, 12:47pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/173513/4 "2019-05-01T12:47:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.