Describe the enhancement:

Create a beat processor is capable of converting a character set to UTF-8.

- if.equals.content_type: gbk
  then:
    decode_charset:
      field: http.response.body.content
      charset: gbk

Describe a specific use case for the enhancement or feature:

If the Content-Type header specifies a charset that's not UTF-8 then the http.response.body.content or http.request.body.content fields will not be very usable within Elasticsearch since it expects a UTF-8 encoding.

For example if we had a content type header like this then I would like to have a means of converting the body

Content-Type: text/html; charset=gb2312

The linked discuss is another use case and does not use a Content-Type header, but instead an XML body that specifies the encoding.

Related

• https://discuss.elastic.co/t/i-have-a-question-about-packetbeat-character-encoding/350637
• https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_encoding_3