# Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71

**URL:** <https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604>\
**Category:** Logstash\
**Created:** [June 25, 2020, 6:33am UTC](https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604 "2020-06-25T06:33:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Magesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh/32/57923_2.png) [@Magesh](https://discuss.elastic.co/u/Magesh)\
**Post date:** [June 25, 2020, 6:33am UTC](https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604/1 "2020-06-25T06:33:51Z")

</div>

Hi,  
I'm Using Filebeat 8.0/Logstash8.0/Elasticsearch8.0 version in windows 10 environment and i'm trying to send the logs from filebeat--\>logstash--\>elasticsearch.  
post start of filebeat / logstash/elasticsearch, i'm getting the below error in logstash console.

Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71  
[2020-06-25T11:43:51,121][WARN][io.netty.channel.DefaultChannelPipeline][main][80b24821c663bec2fff9240ae2e408e735ec2836d9902e005222cd89c27fbbc4] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.

My Filebeat.yml file

filebeat.inputs:

- type: log
- C:\Users\ELK\*.log

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

# Array of hosts to connect to.

# hosts: ["localhost:9200"]

# Protocol - either `http` (default) or `https`.

#protocol: "https"

# Authentication credentials - either API key or username/password.

#api\_key: "id:api\_key"  
#username: "elastic"  
#password: "changeme"

# ------------------------------ Logstash Output -------------------------------

#output.logstash:

# The Logstash hosts

hosts: "localhost:5044"

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

My Logstash config file

input {  
beats {  
port =\> 5044  
ssl =\> false  
}  
}

output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 25, 2020, 4:04pm UTC](https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604/2 "2020-06-25T16:04:52Z")

</div>

You have uncommented

```
output.elasticsearch:

```

and commented

```
output.logstash:

```

so filebeat will be trying to use http instead of lumberjack as the protocol. That's not going to work.

---

<div class="post-metadata">

**Author:** ![Magesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magesh/32/57923_2.png) [@Magesh](https://discuss.elastic.co/u/Magesh)\
**Post date:** [June 26, 2020, 7:08am UTC](https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604/3 "2020-06-26T07:08:27Z")

</div>

Yes, It's working thanks for highlighting

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2020, 7:08am UTC](https://discuss.elastic.co/t/handling-exception-org-logstash-beats-invalidframeprotocolexception-invalid-version-of-beats-protocol-71/238604/4 "2020-07-24T07:08:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.