Timestamp in Windows event message encoded ANSI/Windows-12 adds garbage value when converted in utf8 by winlogbeat

Elastic Stack Beats
1

The windows event message is below

event
event896×230 33.2 KB

when converted to utf8, it is adding garbage value

"The system time has changed to ‎2022‎-‎03‎-‎08T09:51:08.763000000Z from ‎2022‎-‎03‎-‎08T09:50:14.842044400Z."

Winlogbeat directly read the message as utf8, which results the addition of garbage value in the message.

Is there any way to read in ANSI/Windows-12 encoded message and then convert it into utf-8 format?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

4

Could you run the Winlogbeat event reader for that channel with the include_xml: true config option. Then share the raw JSON document produced by Winlogbeat that contains everything including the XML. This will help me understand what is happening.