# Trouble with log in UCS-2 LE BOM encoding

**URL:** <https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 6, 2019, 9:55pm UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487 "2019-09-06T21:55:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_finack](https://avatars.discourse-cdn.com/v4/letter/_/e68b1a/32.png) [@\_finack](https://discuss.elastic.co/u/_finack)\
**Post date:** [September 6, 2019, 9:55pm UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487/1 "2019-09-06T21:55:30Z")

</div>

I'm new to filebeat. I have a log file in UCS-2 LE BOM encoding. Log entries are each their own valid JSON object, one per line.

Filebeat does not seem to like the UCS-2 LE BOM encoding. I'm seeing the following in the filebeat output:

```
    "json": {
"error": {
  "message": "Error decoding JSON: invalid character '\\x00' looking for beginning of object key string",
  "type": "json"
}
},
"message": "{\u0000\"\u0000I\u0000D\u0000\"\u0000:\u00006\u00002\u0000,\u0000\"\u0000T\u0000r\u0000a\u0000n\u0000s\....(a lot more of this)

```

In the filebeat.yml config file, I've tried all of the following. The result is the same with all of them.

```
encoding: utf-16
encoding: utf-16-bom
encoding: utf-16le-bom

```

If I use Notepad++ and convert the file to UTF-8 encoding, then filebeat has no trouble reading the file with this config setting:

```
encoding: utf-8

```

However, our logging process that writes to the log file then chokes after the conversion to UTF-8.

This is filebeat 7.3.0 on Windows Server 2016 reading a local log file. Any help would be much appreciated.

---

<div class="post-metadata">

**Author:** ![\_finack](https://avatars.discourse-cdn.com/v4/letter/_/e68b1a/32.png) [@\_finack](https://discuss.elastic.co/u/_finack)\
**Post date:** [September 17, 2019, 6:08pm UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487/2 "2019-09-17T18:08:37Z")

</div>

I was able to work with one of the developers so they could write logs successfully to the UTF-8 encoded version of the log file, which filebeat successfully reads.

I was never able to solve the issue with filebeat successfully reading the log file in UCS-2 LE BOM encoding.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2019, 8:08pm UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487/3 "2019-10-15T20:08:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![Toby-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/toby-elastic/32/56715_2.png) [@Toby-Elastic](https://discuss.elastic.co/u/Toby-Elastic)\
**Post date:** [July 24, 2020, 7:12am UTC](https://discuss.elastic.co/t/trouble-with-log-in-ucs-2-le-bom-encoding/198487/4 "2020-07-24T07:12:28Z")

</div>

For anyone hitting the same issue, the problem is probably caused by not adding the `encoding` under an `input` section. It needs to look like this to work:

```
- module: mssql
  # Fileset for native deployment
  log:
    enabled: true
    var.paths: ["Path to Server Logs"]
    input:
        encoding: utf-16le-bom
```