CODEWITHSUNDEEP
logstashlogstash-configurationelastic-stacklogstash-forwarder
leeman24
leeman24

Reputation: 2899

Logstash - Change charset - Received an event that has a different character encoding than you configured

I have the ELK stack (with logstash-forwarder) setup and it appears to be working for JBoss logs. I found that I was unable to get other logs on a working server which was odd. I checked /var/log/logstash/logstash.log and it contained the error below:

{:timestamp=>"2016-03-02T16:02:25.232000-0500", :message=>"Received an event that has a different character encoding than you configured.", :text=>"\\tat company.core.controller.flat.FlatApplicationController.\\xFB(FlatApplicationController.java:3242)", :expected_charset=>"UTF-8", :level=>:warn}

Reading online, it appears that I would have to specify the charset my log file is using. I checked the WebSphere defaults for en which is ISO-8859. I am having trouble applying this to my configuration.

I used the following guide - https://gist.github.com/ashrithr/c5c03950ef631ac63c43.

I tried to add "charset => "ISO-8859-1"" to the /etc/logstash/conf.d/01-lumberjack-input.conf file:

input {
  lumberjack {
    port => 5000
    type => "logs"
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
    charset => "ISO-8859-1"
  }
}

That did not seem to work as I get the same error.

Can someone provide instructions on how to set the character set corretly?

Upvotes: 1

Views: 6310

Answers (2)

Jonathan Swift
Jonathan Swift

Reputation: 21

If you are running both a tcp input like lumberjack and a udp input (say gelf) on the same port, you will get an error "Received an event that has a different character encoding...".

This is due to the udp input attempting to interpret the tcp handshake packet. It will fail unless you run the input listeners on different ports.

This will work:

input {
  lumberjack {
    port => "5001"
    ssl_certificate => "/some/path/cert"
    ssl_key => "/some/path/cert.key"
             }

  gelf       {
    port => "5000"
             }
}

This will give you an encoding error:

input {
      lumberjack {
        port => "5000"
        ssl_certificate => "/some/path/cert"
        ssl_key => "/some/path/cert.key"
                 }

      gelf       {
        port => "5000"
                 }
}

Upvotes: 2

HauLuk
HauLuk

Reputation: 155

I think you have to use the plain text option and there you can change the charset.

codec => plain { charset => "ISO-8859-1" }

Upvotes: 0

Related Questions