Unrecognizable messages

I have installed filebeats on Centos6
I have the filebeats reading the /var/log/*.log files (just using the default filebeats.yml config)
I have filebeats sending the events to logstash then to ES.
All I see is messages that look like this?

What is this and what did I miss?

2F4PF\aM\xC3I#\f\x9A0\xD6B\xAFE\x95\xF8u\xBC\xBA\x8A\u0017\e\u001Co\x9A\xF4+\xD1\u0011\xB5\xF8d&BȲ\r\xE6\u0018\xAA\x83\u007F\xA8\xB7\"S\x9D\u000Ef\u000F\xA2S\xFD0\xB0\xA6\xE0\xDCU\xF5\xE2F0FE\x8EB\x80*\u00117\xB9v0\u0004\xA4\x9E\xE8\xF6CA\u001D\\ͧ\x9Ekcj\"R\xF8G\x84\xAC\xD7hI\xE1\xA0\xFA\xB2\xA8\x84\u0006\x8F\xD4OU\xE06\xC2\u0012V\u0012\xB8-\xE7#\xEA3u\xF0Ķ:\\'\x84\xB1\xD6ӷ:\xD6\xF7\u0016\x93[\x9Bk\xFA\u007F\xAE\x97i\xAA\xAA\xA1>\u0004\x90\u007FB\xC8\xF2\xB4\u0000\xE9\x99\u0000$=\xEF\xAC:m\u000F\u001CO\xC1g▻\xAE\xBAJ\xF0\xADis\u001A\xEChdjq\x9F\xB9

  1. What version of Filebeat and Logstash are you using?

  2. For debugging purposes, could you temporarily set output.logstash.enabled: false and output.console.enabled: true? This will output the logs being harvested by Filebeat to the console instead of sending them to Logstash. Then restart Filebeat and check the console output to see if you're seeing the same garbled characters as you posted. That'll at least help us narrow down to where the problem might be in Filebeat -> Logstash -> ES.

Thanks,

Shaunak

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.