Timestamp in Windows event message encoded ANSI/Windows-12 adds garbage value when converted in utf8 by winlogbeat

Elastic Stack Beats
#1

The windows event message is below

event
event896×230 33.2 KB

when converted to utf8, it is adding garbage value

"The system time has changed to ‎2022‎-‎03‎-‎08T09:51:08.763000000Z from ‎2022‎-‎03‎-‎08T09:50:14.842044400Z."

Winlogbeat directly read the message as utf8, which results the addition of garbage value in the message.

Is there any way to read in ANSI/Windows-12 encoded message and then convert it into utf-8 format?

#2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.