# Windows DNS incompatible character encodings

**URL:** <https://discuss.elastic.co/t/windows-dns-incompatible-character-encodings/48961>\
**Category:** Logstash\
**Created:** [May 2, 2016, 2:09pm UTC](https://discuss.elastic.co/t/windows-dns-incompatible-character-encodings/48961 "2016-05-02T14:09:59Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![BongoEADGC6](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@BongoEADGC6](https://discuss.elastic.co/u/BongoEADGC6)\
**Post date:** [May 4, 2016, 6:10am UTC](https://discuss.elastic.co/t/windows-dns-incompatible-character-encodings/48961/5 "2016-05-04T06:10:08Z")

</div>

This is the output of my plugins list.

> /opt/logstash/bin/logstash-plugin list --verbose  
> logstash-codec-collectd (2.0.4)  
> logstash-codec-dots (2.0.4)  
> logstash-codec-edn (2.0.4)  
> logstash-codec-edn\_lines (2.0.4)  
> logstash-codec-es\_bulk (2.0.4)  
> logstash-codec-fluent (2.0.4)  
> logstash-codec-graphite (2.0.4)  
> logstash-codec-json (2.1.3)  
> logstash-codec-json\_lines (2.1.3)  
> logstash-codec-line (2.1.2)  
> logstash-codec-msgpack (2.0.4)  
> logstash-codec-multiline (2.0.11)  
> logstash-codec-netflow (2.0.5)  
> logstash-codec-oldlogstashjson (2.0.4)  
> logstash-codec-plain (2.0.4)  
> logstash-codec-rubydebug (2.0.7)  
> logstash-filter-anonymize (2.0.4)  
> logstash-filter-checksum (2.0.4)  
> logstash-filter-clone (2.0.6)  
> logstash-filter-csv (2.1.3)  
> logstash-filter-date (2.1.6)  
> logstash-filter-dns (2.1.3)  
> logstash-filter-drop (2.0.4)  
> logstash-filter-fingerprint (2.0.5)  
> logstash-filter-geoip (2.0.7)  
> logstash-filter-grok (2.0.5)  
> logstash-filter-json (2.0.6)  
> logstash-filter-kv (2.0.7)  
> logstash-filter-metrics (3.0.2)  
> logstash-filter-multiline (2.0.5)  
> logstash-filter-mutate (2.0.6)  
> logstash-filter-ruby (2.0.5)  
> logstash-filter-sleep (2.0.4)  
> logstash-filter-split (2.0.5)  
> logstash-filter-syslog\_pri (2.0.4)  
> logstash-filter-throttle (2.0.4)  
> logstash-filter-urldecode (2.0.4)  
> logstash-filter-useragent (2.0.8)  
> logstash-filter-uuid (2.0.5)  
> logstash-filter-xml (2.1.3)  
> logstash-input-beats (2.2.7)  
> logstash-input-couchdb\_changes (2.0.4)  
> logstash-input-elasticsearch (2.0.5)  
> logstash-input-eventlog (3.0.3)  
> logstash-input-exec (2.0.6)  
> logstash-input-file (2.2.5)  
> logstash-input-ganglia (2.0.6)  
> logstash-input-gelf (2.0.5)  
> logstash-input-generator (2.0.4)  
> logstash-input-graphite (2.0.7)  
> logstash-input-heartbeat (2.0.4)  
> logstash-input-http (2.2.2)  
> logstash-input-http\_poller (2.0.5)  
> logstash-input-imap (2.0.5)  
> logstash-input-irc (2.0.5)  
> logstash-input-jdbc (3.0.2)  
> logstash-input-kafka (2.0.6)  
> logstash-input-log4j (2.0.7)  
> logstash-input-lumberjack (2.0.7)  
> logstash-input-pipe (2.0.4)  
> logstash-input-rabbitmq (4.0.1)  
> logstash-input-redis (2.0.6)  
> logstash-input-s3 (2.0.6)  
> logstash-input-snmptrap (2.0.4)  
> logstash-input-sqs (2.0.5)  
> logstash-input-stdin (2.0.4)  
> logstash-input-syslog (2.0.5)  
> logstash-input-tcp (3.0.4)  
> logstash-input-twitter (2.2.2)  
> logstash-input-udp (2.0.5)  
> logstash-input-unix (2.0.6)  
> logstash-input-xmpp (2.0.5)  
> logstash-input-zeromq (2.0.4)  
> logstash-output-cloudwatch (2.0.4)  
> logstash-output-csv (2.0.5)  
> logstash-output-elasticsearch (2.5.5)  
> logstash-output-email (3.0.5)  
> logstash-output-exec (2.0.4)  
> logstash-output-file (2.2.5)  
> logstash-output-ganglia (2.0.4)  
> logstash-output-gelf (2.0.5)  
> logstash-output-graphite (2.0.5)  
> logstash-output-hipchat (3.0.4)  
> logstash-output-http (2.1.3)  
> logstash-output-irc (2.0.4)  
> logstash-output-juggernaut (2.0.4)  
> logstash-output-kafka (2.0.3)  
> logstash-output-lumberjack (2.0.6)  
> logstash-output-nagios (2.0.4)  
> logstash-output-nagios\_nsca (2.0.5)  
> logstash-output-null (2.0.4)  
> logstash-output-opentsdb (2.0.4)  
> logstash-output-pagerduty (2.0.4)  
> logstash-output-pipe (2.0.4)  
> logstash-output-rabbitmq (3.0.9)  
> logstash-output-redis (2.0.4)  
> logstash-output-s3 (2.0.7)  
> logstash-output-sns (3.0.4)  
> logstash-output-sqs (2.0.4)  
> logstash-output-statsd (2.0.7)  
> logstash-output-stdout (2.0.6)  
> logstash-output-tcp (2.0.4)  
> logstash-output-udp (2.0.4)  
> logstash-output-xmpp (2.0.4)  
> logstash-output-zeromq (2.0.4)  
> logstash-patterns-core (2.0.5)

This is my windows DNS debug log pattern

> WINDNS %{NUMBER:log\_date} %{TIME:log\_time} %{WORD:dns\_thread\_id} %{WORD:dns\_context}%{SPACE}%{WORD:dns\_packet\_id} %{WORD:dns\_ip\_protocol} %{WORD:dns\_direction} %{IP:dns\_client\_address}%{SPACE}%{WORD:dns\_xid}%{SPACE}(?:Q|R|U) ?(Q|R|U)?%{SPACE}[%{GREEDYDATA:dns\_hex\_flags}%{SPACE}%{WORD:dns\_response}]%{SPACE}%{WORD:dns\_recordtype}%{SPACE}([1-9][0-9]?)%{GREEDYDATA:dns\_query\_name}

---

_[View the full topic](https://discuss.elastic.co/t/windows-dns-incompatible-character-encodings/48961)._