{"action":"closed","issue":{"url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/86","repository_url":"https://api.github.com/repos/Graylog2/collector-sidecar","labels_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/86/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/86/comments","events_url":"https://api.github.com/repos/Graylog2/collector-sidecar/issues/86/events","html_url":"https://github.com/Graylog2/collector-sidecar/issues/86","id":185403815,"number":86,"title":"Reading in UTF-16LE Log Files (MSSQL)","user":{"login":"Fossiltalk","id":12259193,"avatar_url":"https://avatars.githubusercontent.com/u/12259193?v=3","gravatar_id":"","url":"https://api.github.com/users/Fossiltalk","html_url":"https://github.com/Fossiltalk","followers_url":"https://api.github.com/users/Fossiltalk/followers","following_url":"https://api.github.com/users/Fossiltalk/following{/other_user}","gists_url":"https://api.github.com/users/Fossiltalk/gists{/gist_id}","starred_url":"https://api.github.com/users/Fossiltalk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fossiltalk/subscriptions","organizations_url":"https://api.github.com/users/Fossiltalk/orgs","repos_url":"https://api.github.com/users/Fossiltalk/repos","events_url":"https://api.github.com/users/Fossiltalk/events{/privacy}","received_events_url":"https://api.github.com/users/Fossiltalk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-26T14:07:01Z","updated_at":"2016-10-26T14:18:11Z","closed_at":"2016-10-26T14:18:11Z","body":"### Problem description\r\nI'm trying to read in MSSQL logs, which are UTF-16 LE encoded.  I know I have to modify the filebeat configuration to accommodate this, but whenever I try adding encoding:utf-16le as a beats snippet, it does not appear to change filebeat's behavior.\r\n\r\nIn graylog, this results in an inability to write extractors for the log messages.  I believe this is because the messages are being read as UTF-8, meaning that UTF-8 character is being read, followed by a null character for each UTF-16 character.  This becomes more evident when you show terms on a log message:\r\n\r\n![screenshot 72](https://cloud.githubusercontent.com/assets/12259193/19729112/d8558d1c-9b63-11e6-9563-9e90d5c80861.png)\r\n\r\nTo get around this an extractor has to be written to re-write the message body without each of those null characters, or to accommodate them in-line, which is rather expensive.\r\n\r\n### Steps to reproduce the problem\r\n\r\n1.   Importing MSSQL Logs or any other document that is UTF-16 LE encoded should cause the issue to occur.\r\n\r\n### Environment\r\n\r\n* Sidecar Version: 0.0.9 (stable)\r\n* Graylog Version: 2.1.1+01d50e5\r\n* Operating System: Windows Server 2008 R2 (client)  Ubuntu Server 14.04.5 LTS (server)\r\n* Elasticsearch Version: 2.4.1\r\n* MongoDB Version: 2.4.9\r\n\r\n"}}
{"actor":{"display_login":"Fossiltalk"}}