# Syslog input, received character set?

**URL:** <https://discuss.elastic.co/t/syslog-input-received-character-set/34426>\
**Category:** Logstash\
**Created:** [November 12, 2015, 2:58pm UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426 "2015-11-12T14:58:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [November 12, 2015, 2:58pm UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426/1 "2015-11-12T14:58:06Z")

</div>

I'm on linux using the logstash syslog input and ruby debug output but am getting this error:

```
Received an event that has a different character encoding than you configured. {:text=>"\\u0000\\u0005 ...", :expected_charset=>"UTF-8", :level=>:warn}

```

I added:

```
codec => plain {charset => "ISO-8859-1"}

```

... and am getting no error but the "message" is still not legible (\u0016\u0003, etc.). I've tried a couple other character sets with no better results.

Is there any way I can determine on the receiving end what charset is being used? Perhaps in a ruby filter? The log sender is saying he's using syslog out of the box and is not aware of charset being used.

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [November 12, 2015, 3:36pm UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426/2 "2015-11-12T15:36:08Z")

</div>

UPDATE:

I added some ruby code in a filter:

```
filter{
    ruby{
        code =>"
            e = event['message'].encoding;
            puts e;
        "
    }
}

```

The output is "UTF-8"! But does this indicate what I'm receiving is UTF-8 or is it being converted somehow before the encoding output?

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [November 12, 2015, 5:48pm UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426/3 "2015-11-12T17:48:36Z")

</div>

UPDATE:  
The sender of the syslogs records is now telling me that his text is encrypted. The Logstash syslog input plugin doesn't seem to have that facility so now I'm trying a combination of the tcp input plugin and a grok filter but I'm not getting much farther. I'm specifying ssl\_enable=\>true and am specifying the same crt file for ssl\_cacert as he's using for "DefaultNetstreamDriverCAFile" in his syslog config. The error I'm now getting is:

```
Could not initialize SSL context {:exception=>#TypeError: can't convert nil into String>, :backtrace=>["org/jruby/RubyIO.java:3785:in 'read'", "org/jruby/RubyIO.java:3968:in 'read'",<more but too long to type in>

```

My config is now:

```
input{
    tcp{
        port => 5140
        ssl_enable => true
        ssl_cacert => "/etc/httpd/connf/myCAcert.crt"
    }
}
# filter{
# grok{
# ...
# }
#}
output{
    stdout{codec => rubydebug}
}

```

I don't see where the nil string is coming from. Do I need to specify ss\_cert, ssl\_key and ssl\_key\_passphrase?

---

<div class="post-metadata">

**Author:** ![CraigFoote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craigfoote/32/4571_2.png) [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Post date:** [November 12, 2015, 7:57pm UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426/4 "2015-11-12T19:57:17Z")

</div>

Found a nice article at [http://blog.eagerelk.com/how-to-configure-the-tcp-logstash-input/](http://blog.eagerelk.com/how-to-configure-the-tcp-logstash-input/) but I'd still like more information on the SSL config options. For instance if I set the ssl\_cert option to the sender's public .cer file, do I need to set the ssl\_key and ssl\_key\_passphrase options? And is the ssl\_cacerts option supposed to be the truststore file with the public certificates of all the people I can trust?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/syslog-input-received-character-set/34426/5 "2017-07-06T05:22:57Z")

</div>