Logstash:接收到具有不同字符编码的事件
使用logstash时,我看到如下错误:Logstash:接收到具有不同字符编码的事件,logstash,Logstash,使用logstash时,我看到如下错误: Received an event that has a different character encoding than you configured. {:text=>"2014-06-22T11:49:57.832631+02:00 10.17.22.37 date=2014-06-22 time=11:49:55 device_id=LM150D9L23000422 log_id=0312318759 type=statistics pr
Received an event that has a different character encoding than you configured. {:text=>"2014-06-22T11:49:57.832631+02:00 10.17.22.37 date=2014-06-22 time=11:49:55 device_id=LM150D9L23000422 log_id=0312318759 type=statistics pri=information session_id=\\\"s617nnE2019973-s617nnE3019973\\\" client_name=\\\"[<IP address>]\\\" dst_ip=\\\"<ip address>\\\" from=\\\"machin@machin.fr\\\" to=\\\"truc@machin.fr\\\" polid=\\\"0:1:1\\\" domain=\\\"machin.fr\\\" subject=\\\"\\xF0\\xCC\\xC1\\xD4\\xC9 \\xD4\\xCF\\xCC\\xD8\\xCB\\xCF \\xDA\\xC1 \\xD0\\xD2\\xCF\\xC4\\xC1\\xD6\\xC9!\\\" mailer=\\\"mta\\\" resolved=\\\"OK\\\" direction=\\\"in\\\" virus=\\\"\\\" disposition=\\\"Quarantine\\\" classifier=\\\"FortiGuard AntiSpam\\\" message_length=\\\"1024\\\"", :expected_charset=>"UTF-8", :level=>:warn}
}
我不知道什么编解码器应该用于事件的正确格式??
问题出在主题字段。这是因为默认字符集是UTF-8,而传入消息包含的字符不在UTF-8集中 要修复此集,请使用编解码器和正确的字符集修复输入部分中的字符集。比如说
file {
path => "var/log/http/access_log"
type => apache_access_log
codec => plain {
charset => "ISO-8859-1"
}
stat_interval => 60
}
如果您从外部服务器收到日志,请尝试使用:
input {
udp {
port => yourListenPort
type => inputType
codec => plain {
charset => "ISO-8859-1"
}
}
}
我有同样的错误,我用这个,工作
file {
path => "var/log/http/access_log"
type => apache_access_log
codec => plain {
charset => "ISO-8859-1"
}
stat_interval => 60
}
input {
udp {
port => yourListenPort
type => inputType
codec => plain {
charset => "ISO-8859-1"
}
}
}