Hi I am setting up ELK stack for POC.
I have installed ELK 7.17 version. Installed all the packages separately like different machine.
Now i have installed file beat and enabled logstash module but i don't see any logs coming to logstash.
tried few things like.
filebeat test output
logstash: ip:5044...
connection...
parse host... OK
dns lookup... OK
addresses: ip
dial up... OK
TLS... WARN secure connection disabled
talk to server... OK
But when i do telnet on the log stash ip from the node. Seeing few errors in log stash like this.
[2022-11-15T12:40:33,032][INFO ][org.logstash.beats.BeatsHandler][main][cccda7e3f21e688691fa7337a0f554a903e80b213415b70f816cb647d30a4675] [local: 10.0.61.141:5044, remote: 10.0.60.127:57066] Handling exception: io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 10 (caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 10)
[2022-11-15T12:40:33,033][WARN ][io.netty.channel.DefaultChannelPipeline][main][cccda7e3f21e688691fa7337a0f554a903e80b213415b70f816cb647d30a4675] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 10
Seen few questions with same error, but i haven't enabled Elasticsearch in filebeat config file.
# ---------------------------- Elasticsearch Output ----------------------------
#output.elasticsearch:
# Array of hosts to connect to.
#hosts: ["ip:9200"]
# Protocol - either `http` (default) or `https`.
#protocol: "https"
# Authentication credentials - either API key or username/password.
#api_key: "id:api_key"
#username: ""
#password: ""
# ------------------------------ Logstash Output -------------------------------
output.logstash:
# The Logstash hosts
hosts: ["ip:5044"]
Here is the beats input conf file
input {
beats {
port => 5044
ssl => false
}
}
output {
if [fields][type] == "apache_logs"
{
elasticsearch {
hosts => ["ip:9200"]
user => "un"
password => "pwd"
index => "apache-logs"
}
stdout { codec => rubydebug }
}
}