Hi there, I have a Logstash configuration sitting on an EC2 machine where I push a certain set of data from a machine on port 5044, and a different set on 5045. I never get this error for port 5044 but always for port 5045. I've read that it may be an SSL error, but I'm not sure why then I only get an error in one port.
This is the error:
[2019-11-20T04:43:37,790][INFO ][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XX.XXX.XX.XX:52482] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
[2019-11-20T04:43:37,797][INFO ][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XXX.XX.XX.XX:52516] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
[2019-11-20T04:43:37,801][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
1,1 Top
at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
My filebeat is:
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]
filebeat.inputs:
- type: log
tags: ["test"]
# Change to true to enable this input configuration.
enabled: true
# clean_inactive: 1m
# ignore_older: 15s
# scan_frequency: 10s
# close_eof: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- c:\test
# multiline.pattern: 'FEATURE'
multiline.pattern: '^Mqksds'
multiline.negate: true
multiline.match: after
output.logstash:
# The Logstash hosts
hosts: ["ec2-xx-xx-xx-xx.compute-1.amazonaws.com:5045"]
And logstash config is the standard input:
input {
beats {
port => 5044
}
}