Hi Im testing the 5-alpha ELK stack on Ubuntu 16.04 (x64) and when I enable the beats input (no ssl) the syslog on the logstash server shows this error every 1 minute:
[nioEventLoopGroup-3-1] ERROR org.logstash.beats.BeatsHandler - Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
The beats input still seems to be working however it is receiving filebeats and winlogbeats
I have the same error:
[nioEventLoopGroup-3-2] ERROR org.logstash.beats.BeatsHandler - Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
[nioEventLoopGroup-3-3] ERROR org.logstash.beats.BeatsHandler - Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
I have 5 servers running winlogbeat and metricbeat. But only one server is able to add data to the index.
I have deleted the index and try whit only one of the servers that do not work. but still the same error and no data in the index
Runing 5.0.0-alpha5 on every thing.
@xternal @tellus83 Were you able to get past this error? I am facing the same issue with logstash 5.0.0 and filebeat version 5.0.0 (amd64), libbeat 5.0.0 though I am getting a different frame type.
2016-10-30T17:55:11,932][ERROR][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69
[2016-10-30T17:55:11,933][ERROR][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
logstash is running on Ubuntu 16.04 and filebeat is from a mac machine.
This is the search result in Google.
The search result for my own error 
The 69 and 84 came when I
If you find this page with Google, too: Now lok what I did to the "hosts" parameter of output.elasticsearch!!!
(Yes, that remained in my case the parent config setting where I cahnged the hosts parameter for.)
So this error with 64 and 89 happens when you send beats for elasitcsearch into logstash 
It seems there are a few people having this issue, but can't figure out what exactly is causing it. There is another thread where the frame type received is 3 & 1.
This error clearly means that you are not receiving the format which is required in logstash. So, you need to go to check whether your filebeat.yml configuration is fine.
I faced the same issue today, and came to know that the output section of filebeat wasn't properly set.
So make sure that if elasticsearch is uncommented in filebeat.yml section, the hosts line below it is uncommented. Otherwise if logstash is uncommented, the corresponding line of hosts must be uncommented.
This can happen when something that is not a valid Beats protocol is connecting to the Beats input.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.