# Filebeat Invalid Frame Type Error

**URL:** <https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 25, 2018, 5:00am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250 "2018-05-25T05:00:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kavinda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavinda/32/31586_2.png) [@kavinda](https://discuss.elastic.co/u/kavinda)\
**Post date:** [May 25, 2018, 5:00am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250/1 "2018-05-25T05:00:47Z")

</div>

Hi All

I have ELK stack running on AWS and i wanted to get logs from my windows PC as a filebeat stream so i installed filebeat in that windows host when i run my logstash configuration i get the fallowing error

```
[2018-05-24T06:34:18,140][INFO][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84, from: /[My WindowsHost IP]:51701
[2018-05-24T06:34:34,296][INFO][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69, from: /[My WindowsHost IP]:51702
[2018-05-24T06:34:34,297][INFO][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84, from: /[My WindowsHost IP]:51702

```

because its getting my windows host ip, logstash is getting the filebeat stream but port number is different from one to another as the stream goes

but in my windows host filebeat config has logstash output like this

`hosts: ["http://AWS-EIP:5044"]`

Any ideas ???

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 25, 2018, 5:29am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250/2 "2018-05-25T05:29:28Z")

</div>

Can you tell us the filebeat and logstash versions ?

The discrepancy about the port numbers comes from the fact that logstash is logging the client address (that is filebeat), not it's own address.

---

<div class="post-metadata">

**Author:** ![kavinda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavinda/32/31586_2.png) [@kavinda](https://discuss.elastic.co/u/kavinda)\
**Post date:** [May 25, 2018, 5:32am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250/3 "2018-05-25T05:32:28Z")

</div>

Im using version 5.6.9 for everything

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2018, 5:32am UTC](https://discuss.elastic.co/t/filebeat-invalid-frame-type-error/133250/4 "2018-06-22T05:32:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.