title: Logstash character encoding with cisco syslog
body: <p>I have set up a ELK stack on a server. I configured logstash and and the other things and send syslog test messages to logstash. Everything works fine.</p>
  
  <p>Now i try to send syslog messages from a Cisco WLC and Cisco Switch to logstash and it seems that the message encoding is wrong.</p>
  
  <p>In the logstash logfile i see the following entry (i removed the message)</p>
  
  <p><strong><em>[2018-01-09T16:04:24,603][WARN ][logstash.codecs.plain    ] Received an event that has a different character encoding than you configured. {:text=>"0\x82\u0002B\u0002\u0001\u0001\u000...[REMOVED BECAUSE OF SECURITY PURPOSES], :expected_charset=>"UTF-8"}</em></strong></p>
  
  <p>The input of my logstash config file is the following:</p>
  
  <pre><code>input {
    udp {
      port =&gt; 514
      type =&gt; syslog
      codec =&gt; plain {
       charset =&gt; "ISO-8859-1"
      }
    }
  }
  
  filter {
    if [type] == "syslog" {
      grok {
       match =&gt; { "message" =&gt; "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
       add_field =&gt; [ "received_at", "%{@timestamp}" ]
       add_field =&gt; [ "received_from", "%{host}" ]
      }
      date {
        match =&gt; [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
    }
  }
  
  
  output {
    elasticsearch {
    hosts =&gt; ["localhost:9200"]
    }
  }
  </code></pre>
  
  <p>I already tried to experiment with the codec in the input but with no success. What i am doing wrong? </p>