Troubles with cyrillic data

Elastic Stack Logstash
1

Hello!

I have problems with putting cyrillic data into indices.
I have a messages like

13:32.907017-17,CALL,1,p:processName=ut,Context=ОбщийМодуль.Вызов : ОбщийМодуль.прОбщегоНазначенияСервер.Модуль.ПолучитьТекстОповещенийПользователю,MemoryPeak=926485,InBytes=0,OutBytes=0,CpuTime=0

filebeat.yml

filebeat.inputs:

  • type: log
    enabled: true
    paths
    • C:\1C\calls\rphost**.log
      fields:
      type: onec_call
      fields_under_root: true
      encoding: utf-8

I create logstash config

input {
  stdin {
    codec => json { charset=>"UTF-8" }
  }
}
filter {
  if [type] == "onec_call" {
    grok {
          match => { "message" => ["%{NUMBER:num_min}:%{BASE10NUM:num_sec}-%{WORD:duration},%{WORD:event1c},%{WORD:level_event},p:processName=%{WORD:process1c},Context=%{WORD:context}"]}
    }
  }
}
output {
  stdout { codec => rubydebug }
  elasticsearch {
    index => "onectj-%{+yyyy.MM.dd}"
  }
}

In Kibana, my records tagged as beats_input_codec_plain_applied, _grokparsefailure.
If i delete Context=%{WORD:context} (cyrillic data) from filter block, it works fine.

I tried set codec => plain { charset=>"UTF-8" } in input, remove all codec instructions, but without any result.

What I doing wrong?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.