# Filebeat is unable to send data to Logstash, and very high CPU utilization on filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 12, 2020, 7:58am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-data-to-logstash-and-very-high-cpu-utilization-on-filebeat/255161 "2020-11-12T07:58:20Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Utkarsh\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/utkarsh_jain/32/78880_2.png) [@Utkarsh\_Jain](https://discuss.elastic.co/u/Utkarsh_Jain)\ **Post date:** [November 12, 2020, 7:58am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-data-to-logstash-and-very-high-cpu-utilization-on-filebeat/255161/1 "2020-11-12T07:58:20Z")
Hello, Everything was working fine for us but after a security patch update, the CPU utilization is very high on filebeat server and logstash is not recieving data from filebeat. Here are the logs from logstash server. `[2020-11-12T15:36:24,575][WARN][io.netty.channel.DefaultChannelPipeline][twamp] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: -1 at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final] at java.lang.Thread.run(Unknown Source) [?:1.8.0_211] Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: -1 at org.logstash.beats.Protocol.version(Protocol.java:22) ~[logstash-input-beats-6.0.8.jar:?] at org.logstash.beats.BeatsParser.decode(BeatsParser.java:62) ~[logstash-input-beats-6.0.8.jar:?] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] ... 8 more [2020-11-12T15:36:24,616][INFO][org.logstash.beats.BeatsHandler][twamp] [local: 202.166.118.75:5045, remote: 202.166.118.36:55664] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: -12 [2020-11-12T15:36:24,619][WARN][io.netty.channel.DefaultChannelPipeline][twamp] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: -12 at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:405) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:372) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:355) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final] at java.lang.Thread.run(Unknown Source) [?:1.8.0_211] Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: -12 at org.logstash.beats.Protocol.version(Protocol.java:22) ~[logstash-input-beats-6.0.8.jar:?] at org.logstash.beats.BeatsParser.decode(BeatsParser.java:62) ~[logstash-input-beats-6.0.8.jar:?] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final] ... 10 more ` ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [November 12, 2020, 9:43am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-data-to-logstash-and-very-high-cpu-utilization-on-filebeat/255161/2 "2020-11-12T09:43:34Z")
To fully understand the problem, is the high CPU usage caused by producing too many error logs or it was hight in general? Could you please share which security patch did you apply? ---
**Author:** ![Utkarsh\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/utkarsh_jain/32/78880_2.png) [@Utkarsh\_Jain](https://discuss.elastic.co/u/Utkarsh_Jain)\ **Post date:** [November 12, 2020, 9:52am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-data-to-logstash-and-very-high-cpu-utilization-on-filebeat/255161/3 "2020-11-12T09:52:25Z")
Hello, Actually there are no error logs. There are just regular monitoring logs. The RHEL7 OS security patch. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 10, 2020, 11:52am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-data-to-logstash-and-very-high-cpu-utilization-on-filebeat/255161/4 "2020-12-10T11:52:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.