title: Logstash: Received an event that has a different character encoding
body: <p>when using logstash I see an error like this one :</p>
  
  <pre><code>Received an event that has a different character encoding than you configured. {:text=&gt;"2014-06-22T11:49:57.832631+02:00 10.17.22.37 date=2014-06-22 time=11:49:55 device_id=LM150D9L23000422 log_id=0312318759 type=statistics pri=information session_id=\\\"s617nnE2019973-s617nnE3019973\\\" client_name=\\\"[&lt;IP address&gt;]\\\" dst_ip=\\\"&lt;ip address&gt;\\\" from=\\\"machin@machin.fr\\\" to=\\\"truc@machin.fr\\\" polid=\\\"0:1:1\\\" domain=\\\"machin.fr\\\" subject=\\\"\\xF0\\xCC\\xC1\\xD4\\xC9 \\xD4\\xCF\\xCC\\xD8\\xCB\\xCF \\xDA\\xC1 \\xD0\\xD2\\xCF\\xC4\\xC1\\xD6\\xC9!\\\" mailer=\\\"mta\\\" resolved=\\\"OK\\\" direction=\\\"in\\\" virus=\\\"\\\" disposition=\\\"Quarantine\\\" classifier=\\\"FortiGuard AntiSpam\\\" message_length=\\\"1024\\\"", :expected_charset=&gt;"UTF-8", :level=&gt;:warn}
  </code></pre>
  
  <p>my logstash.conf is :</p>
  
  <pre><code> input {
      file{
              path =&gt; "/var/log/fortimail.log"
          }
  </code></pre>
  
  <p>}</p>
  
  <pre><code> filter  {
      grok {
                      # grok-parsing for logs
          }
  }
   output {
      elasticsearch {
              host =&gt; "10.0.10.62"
              embedded =&gt; true
              cluster =&gt; "Mastertest"
              node_name =&gt; "MasterNode"
              protocol =&gt; "http"
      }
  }
  </code></pre>
  
  <p>I do not know what codec should be used for the correct format of events ??
  he problem is in the subject field.</p>