Invalid Frame error

Whenever I am trying to import logs using filebeat on the same server (logstash) I am getting error as:

[INFO ] 2019-02-25 16:59:35.337 [defaultEventExecutorGroup-4-1] BeatsHandler - [local:, remote:] Handling exception:$InvalidFrameProtocolException: Invalid Frame Type, received: 84
[WARN ] 2019-02-25 16:59:35.391 [nioEventLoopGroup-2-2] DefaultChannelPipeline - An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException:$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at io.netty.handler.codec.ByteToMessageDecoder.callDecode( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at$300( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at$ ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$ [netty-all-4.1.30.Final.jar:4.1.30.Final]
at [netty-all-4.1.30.Final.jar:4.1.30.Final]
at [?:1.8.0_181]
Caused by:$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at ~[logstash-input-beats-5.1.8.jar:?]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode( ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
... 10 more

Although while importing logs from different server I ain't getting any such error.

Please help me

Something is connecting to logstash that does not speak the beats protocol on the wire. This could be due to a mismatch in expectations about ssl, or a load balancer intermediating the connection, or various other things. What does your logstash input and filebeat configuration look like?

I will check the filebeat and logstash configuration.

filebeat.yml file looks like


Array of hosts to connect to.

#hosts: [""]

Enabled ilm (beta) to use index lifecycle management instead daily indices.

#ilm.enabled: false

Optional protocol and basic auth credentials.

#protocol: "https"
#username: "elastic"
#password: "changeme"


The Logstash hosts

hosts: [""]

Optional SSL. By default is off.

List of root certificates for HTTPS server verifications

#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.