Getting an error with Logstash/filebeat

Hi there, I have a Logstash configuration sitting on an EC2 machine where I push a certain set of data from a machine on port 5044, and a different set on 5045. I never get this error for port 5044 but always for port 5045. I've read that it may be an SSL error, but I'm not sure why then I only get an error in one port.

This is the error:

[2019-11-20T04:43:37,790][INFO ][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XX.XXX.XX.XX:52482] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
[2019-11-20T04:43:37,797][INFO ][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XXX.XX.XX.XX:52516] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
[2019-11-20T04:43:37,801][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
                                               1,1           Top
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]

My filebeat is:

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]

filebeat.inputs:

- type: log
  tags: ["test"]
  # Change to true to enable this input configuration.
  enabled: true
  # clean_inactive: 1m
  # ignore_older: 15s
  # scan_frequency: 10s
  # close_eof: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - c:\test


  # multiline.pattern: 'FEATURE'
  multiline.pattern: '^Mqksds'
  multiline.negate: true
  multiline.match: after

output.logstash:
  # The Logstash hosts
 
  hosts: ["ec2-xx-xx-xx-xx.compute-1.amazonaws.com:5045"]

And logstash config is the standard input:

input {
	beats {
        port => 5044
    }
}

Do you have any Logstash input listening on port 5045? Can you show it?

I have two pipelines, one has the port 5044 open and the 5045 is identical, other than the "5045" part

@Christian_Dahlqvist Any idea?

Bump, this actually happens on both ports I have connected... It keeps happening and I'm also getting some problems receiving all the data. What can I do?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.