Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69

Elastic Stack Logstash
1

I have 2 logstash machines and both the machines shows the following error in /var/log/logstash.

[2020-06-23T12:12:08,031][INFO ][org.logstash.beats.BeatsHandler][main] [local: logstash_machine_ip:5044, remote: filebeat_machine_ip:56780] Handl
ing exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69
[2020-06-23T12:12:08,032][WARN ][io.netty.channel.DefaultChannelPipeline][main] An exceptionCaught() event was fired, and it reached at 
the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:405) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:372) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:355) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final]
        at java.lang.Thread.run(Thread.java:834) [?:?]

We have around 120 machines where filebeat is installed and filebeat will send the logs to logstash on the dedicated logstash machines and from there it will send to elasticsearch. However, out of 120 machines only 2 machines has issue with logstash . I have gone through the discuss.elastic.co links regarding the same error, but no luck. Someone please help me on this

2

I had installed mericbeat and filebeat on all the machines.. But the metricbeat installed on theses 2 machines had issue with configuration. I had left the below line in the metricbeat.yml file on 2 machines commented. Uncommented it.. It is working fine

output.logstash:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.