Getting "Invalid Frame Type, received: 1" on 6.2.1 stack

Elastic Stack Logstash
1

I'm running out of ideas. Having the 6.2.1 stack installed (ES, Logstash, Kibana and X-Pack). As soon, as I start Filebeat on a host in order to forward syslog messages to the ELK stack, I do get

Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 1

errors in logstash logs.

I've disabled TLS. I've disabled filters. So the logstash config is down to the bare minimum:

input {
  beats {
    port => 5044
    #ssl => true
    #ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    #ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user => filebeat_internal
    password => ***
  }
}

Any help is greatly appreciated.

2

What does your Filebeat configuration look like?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.