# Getting an error with Logstash/filebeat

**URL:** <https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758>\
**Category:** Logstash\
**Created:** [November 20, 2019, 6:52pm UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758 "2019-11-20T18:52:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [November 20, 2019, 6:52pm UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/1 "2019-11-20T18:52:00Z")

</div>

Hi there, I have a Logstash configuration sitting on an EC2 machine where I push a certain set of data from a machine on port 5044, and a different set on 5045. I never get this error for port 5044 but always for port 5045. I've read that it may be an SSL error, but I'm not sure why then I only get an error in one port.

This is the error:

```auto
[2019-11-20T04:43:37,790][INFO][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XX.XXX.XX.XX:52482] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
[2019-11-20T04:43:37,797][INFO][org.logstash.beats.BeatsHandler] [local: XXX.XX.XX.XX:5045, remote: XXX.XX.XX.XX:52516] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
[2019-11-20T04:43:37,801][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
                                               1,1 Top
        at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]

```

My filebeat is:

```auto
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]

filebeat.inputs:

- type: log
  tags: ["test"]
  # Change to true to enable this input configuration.
  enabled: true
  # clean_inactive: 1m
  # ignore_older: 15s
  # scan_frequency: 10s
  # close_eof: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - c:\test

  # multiline.pattern: 'FEATURE'
  multiline.pattern: '^Mqksds'
  multiline.negate: true
  multiline.match: after

output.logstash:
  # The Logstash hosts
 
  hosts: ["ec2-xx-xx-xx-xx.compute-1.amazonaws.com:5045"]

```

And logstash config is the standard input:

```auto
input {
	beats {
        port => 5044
    }
}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 20, 2019, 7:14pm UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/2 "2019-11-20T19:14:36Z")

</div>

Do you have any Logstash input listening on port 5045? Can you show it?

---

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [November 20, 2019, 8:22pm UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/3 "2019-11-20T20:22:24Z")

</div>

I have two pipelines, one has the port 5044 open and the 5045 is identical, other than the "5045" part

---

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [November 21, 2019, 10:26pm UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/4 "2019-11-21T22:26:01Z")

</div>

@Christian_Dahlqvist Any idea?

---

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [December 10, 2019, 3:04am UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/5 "2019-12-10T03:04:33Z")

</div>

Bump, this actually happens on both ports I have connected... It keeps happening and I'm also getting some problems receiving all the data. What can I do?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2020, 3:04am UTC](https://discuss.elastic.co/t/getting-an-error-with-logstash-filebeat/208758/6 "2020-01-07T03:04:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.