# UDP-input Receiving an encoding value �
**URL:** https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199
**Category:** Logstash
**Created:** [August 21, 2023, 6:18am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199 "2023-08-21T06:18:19Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@aurangzeb99](https://discuss.elastic.co/u/aurangzeb99)
#### Post date: [August 21, 2023, 6:18am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/1 "2023-08-21T06:18:19Z")
Hi
I am using logstash udp input and in elasticsearch field event.original have true values. but in a document field.DeviceCapabilities value is "�" and for field.PoleCapabilities is empty.
fieldname: event.original Value: {"fields":{"DeviceCapabilities":"\ufffd\u0004\u0002\u0000\u0000\u0000\u0000\u0000", "PoleCapabilities":"\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"},"timestamp":1692170702}
`field.DeviceCapabilities : �`
`field.PoleCapabilities: `
`"timestamp":1692170702` how I can get my true values in field.
THANKS
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 21, 2023, 7:30am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/2 "2023-08-21T07:30:34Z")
You should add encoder UTF-16 or ISO-8859-1. Full list you have [here](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-plain.html#plugins-codecs-plain-options)
Add to input udp
`codec => plain { charset=>"UTF-16" }`
---
### Author:  [@aurangzeb99](https://discuss.elastic.co/u/aurangzeb99)
#### Post date: [August 21, 2023, 11:43am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/3 "2023-08-21T11:43:47Z")
Not Working
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 21, 2023, 12:54pm UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/4 "2023-08-21T12:54:57Z")
Does this happen for the Entire message or just a couple of fields in some messages? if it is just a couple of fields in some messages, then this does not seem to be a Logstash issue, your source that is sending the data with a different encoding on those fields.
An encoding issue would affect the entire message.
---
### Author:  [@aurangzeb99](https://discuss.elastic.co/u/aurangzeb99)
#### Post date: [August 21, 2023, 12:58pm UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/5 "2023-08-21T12:58:12Z")
its just 2 fields in message
can i use any filter to decode particular fields
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 21, 2023, 6:11pm UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/6 "2023-08-21T18:11:01Z")
If you get \ufffd in your field I believe it is already too late. The data decoder could not interpret the character so it was replaced.
---
### Author:  [@aurangzeb99](https://discuss.elastic.co/u/aurangzeb99)
#### Post date: [August 22, 2023, 6:00am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/7 "2023-08-22T06:00:43Z")
Thanks !!
I will handle this on the source end.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 22, 2023, 6:36am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/8 "2023-08-22T06:36:03Z")
Yes, it would be best. ELK use UTF-8.
By the way, I have used several [UTF-16](https://www.coderstool.com/unicode-text-converter) decoders but couldn't convert the DeviceCapabilities field. Not sure should DeviceCapabilities be a number, string or special characters.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2023, 6:36am UTC](https://discuss.elastic.co/t/udp-input-receiving-an-encoding-value/341199/9 "2023-09-19T06:36:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.