# Troubles with cyrillic data

**URL:** <https://discuss.elastic.co/t/troubles-with-cyrillic-data/220109>\
**Category:** Logstash\
**Created:** [February 20, 2020, 7:25am UTC](https://discuss.elastic.co/t/troubles-with-cyrillic-data/220109 "2020-02-20T07:25:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ImMushroom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/immushroom/32/62992_2.png) [@ImMushroom](https://discuss.elastic.co/u/ImMushroom)\
**Post date:** [February 20, 2020, 7:25am UTC](https://discuss.elastic.co/t/troubles-with-cyrillic-data/220109/1 "2020-02-20T07:25:45Z")

</div>

Hello!

I have problems with putting cyrillic data into indices.  
I have a messages like

> 13:32.907017-17,CALL,1,p:processName=ut,Context=ОбщийМодуль.Вызов : ОбщийМодуль.прОбщегоНазначенияСервер.Модуль.ПолучитьТекстОповещенийПользователю,MemoryPeak=926485,InBytes=0,OutBytes=0,CpuTime=0

filebeat.yml

> filebeat.inputs:
> 
> - type: log  
> enabled: true  
> paths
> - C:\1C\calls\rphost\*\*.log  
> fields:  
> type: onec\_call  
> fields\_under\_root: true  
> encoding: utf-8

I create logstash config

```
input {
  stdin {
    codec => json { charset=>"UTF-8" }
  }
}
filter {
  if [type] == "onec_call" {
    grok {
          match => { "message" => ["%{NUMBER:num_min}:%{BASE10NUM:num_sec}-%{WORD:duration},%{WORD:event1c},%{WORD:level_event},p:processName=%{WORD:process1c},Context=%{WORD:context}"]}
    }
  }
}
output {
  stdout { codec => rubydebug }
  elasticsearch {
    index => "onectj-%{+yyyy.MM.dd}"
  }
}

```

In Kibana, my records tagged as **beats\_input\_codec\_plain\_applied, \_grokparsefailure**.  
If i delete **Context=%{WORD:context}** (cyrillic data) from **filter** block, it works fine.

I tried set **codec =\> plain { charset=\>"UTF-8" }** in **input** , remove all codec instructions, but without any result.

What I doing wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2020, 7:26am UTC](https://discuss.elastic.co/t/troubles-with-cyrillic-data/220109/2 "2020-03-19T07:26:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.