# Exception on configuring Logstash **URL:** \ **Category:** Logstash\ **Created:** [May 28, 2018, 9:43am UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510 "2018-05-28T09:43:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Anca\_Turc](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@Anca\_Turc](https://discuss.elastic.co/u/Anca_Turc)\ **Post date:** [May 28, 2018, 9:43am UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/1 "2018-05-28T09:43:55Z")
Hi , I am trying to filter the traffic for search queries and I have followed this tutorial where is specified the logstash config file sniff\_search.conf. ``` Input { beats { port => 5044 } } filter { if "search" in [request]{ grok { match => { "request" => ".*\n\{(?.*)"} } grok { match => { "path" => "\/(?.*)\/_search"} } If [index] { } else { mutate { add_field => { "index" => "All" } } } mutate { update => { "query_body" => "{%{query_body}" } } } } output { if "search" in [request] and "ignore_unmapped" not in [query_body]{ elasticsearch { hosts => "http://localhost:9200" } } } ``` But when I run ./bin/logstash -f sniff\_search.conf , I have this error [2018-05-28T12:40:31,065][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84 at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:392) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:342) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final] at java.lang.Thread.run(Thread.java:844) [?:?] Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84 at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.15.jar:?] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] ... 10 more If you have any idea what can cause this I would really apreaciate. I just start working with elasticsearch and I cannot see the reason why is happening. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 9:55am UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/2 "2018-05-28T09:55:06Z")
Have you configured Filebeat (or whatever you're using) to use SSL? ---
**Author:** ![Anca\_Turc](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@Anca\_Turc](https://discuss.elastic.co/u/Anca_Turc)\ **Post date:** [May 28, 2018, 10:03am UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/3 "2018-05-28T10:03:13Z")
I am a bit confused . I am using Beats input plugin , which from what I understood enables Logstash to receive events from the Elastic Beats framework, right ? Do I have to configure this one to use SSL ? Thank you very much for your reply ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 11:57am UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/4 "2018-05-28T11:57:15Z")
> I am a bit confused . I am using Beats input plugin , which from what I understood enables Logstash to receive events from the Elastic Beats framework, right ? Yes. > Do I have to configure this one to use SSL ? No, but if you do the Logstash input plugin for beats also needs to have SSL enabled. Please post your Beats configuration file (filebeat.yml or whatever you call it). **Make sure you format it as preformatted text using Markdown notation or using the `` toolbar button.** ---
**Author:** ![Anca\_Turc](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@Anca\_Turc](https://discuss.elastic.co/u/Anca_Turc)\ **Post date:** [May 28, 2018, 1:17pm UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/5 "2018-05-28T13:17:50Z")
Ok , so firstly I successfully installed elasticsearch and kibana. Then I have installed logstash and beats input plugin. Then in logstash home I have created sniff\_search.conf file and after installed Packetbeat and and configured packetbeat.yml file ``` #-------------------------- Elasticsearch output ------------------------------ #output.elasticsearch: # Array of hosts to connect to. # hosts: ["localhost:9200"] # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts hosts: ["localhost:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" ``` But for Beats input plugin I am not sure where I can find yml file . Firstly I am trying to start logstash /bin/logstash -f sniff\_search.conf and after the Packetbeat for sniffing. Also I have read that for Beats input plugin ssl can be enabled like this input { beats { port =\> 5044 ssl =\> true ssl\_certificate\_authorities =\> ["/etc/ca.crt"] ssl\_certificate =\> "/etc/server.crt" ssl\_key =\> "/etc/server.key" ssl\_verify\_mode =\> "force\_peer" } } but I don't know how to generate ssl for localhost . Actually this is the tutorial which I have followed [https://www.elastic.co/blog/monitoring-the-search-queries](https://www.elastic.co/blog/monitoring-the-search-queries) only adapting for localhost, instead of 10.255.4.166. Thank you very much . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2018, 1:17pm UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510/6 "2018-06-25T13:17:52Z")
Closed on June 25, 2018, 1:17pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.