# Filebeat trans logstash for log4j error
**URL:** https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320
**Category:** Logstash
**Created:** [June 11, 2018, 9:08am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320 "2018-06-11T09:08:21Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:08am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/1 "2018-06-11T09:08:22Z")
[root@localhost logstash-6.2.4]# ./bin/logstash -f config/log4j-es.conf
Sending Logstash's logs to /usr/logstash/logstash-6.2.4/logs which is now configured via log4j2.properties
[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"\*", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}
[2018-06-11T16:33:20,391][INFO][logstash.outputs.elasticsearch] New Elasticsearch output \>["main"]}
^[[A^H^H^H^H^H[2018-06-11T16:45:48,209][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5000, remote: 192.168.19.1:55348] Handling exception:
[2018-06-11T16:45:48,256][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5000, remote: 192.168.19.1:55348] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 5
[2018-06-11T16:45:48,210][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: -19
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
... 8 more
[2018-06-11T16:45:48,261][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
java.io.IOException: Connection reset by peer
at sun.nio.ch.FileDispatcherImpl.read0(Native Method) ~[?:1.8.0\_171]
at sun.nio.ch.SocketDispatcher.read(SocketDispatcher.java:39) ~[?:1.8.0\_171]
at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223) ~[?:1.8.0\_171]
at sun.nio.ch.IOUtil.read(IOUtil.java:192) ~[?:1.8.0\_171]
at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:380) ~[?:1.8.0\_171]
at io.netty.buffer.PooledUnsafeDirectByteBuf.setBytes(PooledUnsafeDirectByteBuf.java:288) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.buffer.AbstractByteBuf.writeBytes(AbstractByteBuf.java:1108) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.socket.nio.NioSocketChannel.doReadBytes(NioSocketChannel.java:345) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:126) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_171]
[2018-06-11T16:45:48,262][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 5
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:392) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:342) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_171]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 5
at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.13.jar:?]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
... 10 more
---
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/2 "2018-06-11T09:10:16Z")
-----------log4j-es.conf------
input {
beats {
port =\> "5000"
}
}
output {
elasticsearch {
action =\> "%{[@metadata][action]}"
document\_id =\> "%{[@metadata][\_id]}"
hosts =\> ["192.168.19.128:9200"]
index =\> "filebeat-%{+YYYY.MM.dd}"
}
}
---
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:11am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/3 "2018-06-11T09:11:33Z")
------------firebeat.yml--------------
output.logstash:
hosts: ["192.168.19.128:5000"]
---
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:13am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/4 "2018-06-11T09:13:02Z")
-----------log4j.properties----------------
log4j.rootLogger=INFO,console
log4j.appender.socket=org.apache.log4j.net.SocketAppender
log4j.appender.socket.Port=5000
log4j.appender.socket.RemoteHost=192.168.19.128
log4j.appender.socket.layout=org.apache.log4j.PatternLayout
log4j.appender.socket.layout.ConversionPattern=%d [%-5p] [%l] %m%n
log4j.appender.socket.ReconnectionDelay=1000
---
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:14am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/5 "2018-06-11T09:14:12Z")
------------------java----------------------
/\*\*
- Hello world!
-
\*/
public class App
{
public static void main( String[] args )throws Exception
{
final Logger Log = Logger.getLogger(App.class);
for (int i = 0; i \<6; i++) {
Log.error("Info log [" + i + "].");
Thread.sleep(1000);
}
}
}
---
### Author:  [@flanet](https://discuss.elastic.co/u/flanet)
#### Post date: [June 11, 2018, 9:19am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/6 "2018-06-11T09:19:08Z")
------------- error-------------------
org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 5
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 13, 2018, 6:17am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/7 "2018-06-13T06:17:49Z")
A SocketAppender doesn't use the Beats protocol so you can't configure it to send logs to Logstash's beats input.
Have the Java application write its logs to a file and use Filebeat to ship it. I also strongly recommend that you use a Log4j layout class that produces JSON so you won't have to write Logstash filters to parse the data.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2018, 6:17am UTC](https://discuss.elastic.co/t/filebeat-trans-logstash-for-log4j-error/135320/8 "2018-07-11T06:17:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.