Invalid frame

Hi all, i'm sending logs with filebeat to logstash, but i receive the following error:

[2018-01-25T16:46:48,630][INFO ][org.logstash.beats.BeatsHandler] [local: 172.16.0.4:5043, remote: 172.16.0.64:48316] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: -12
[2018-01-25T16:46:48,652][INFO ][org.logstash.beats.BeatsHandler] [local: 172.16.0.4:5043, remote: 172.16.0.64:48316] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: -1

and no logs are sent.

Can you help me???

Please show your Filebeat configuration as well as the beats input configuration in Logstash.

Filebeat config:

filebeat.prospectors:

  • type: log
    enabled: true
    paths:
    • /opt/jboss/server/default/log/server.log
      fields: {log_type: worldmatch}
      multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      multiline.negate: true
      multiline.match: after
      filebeat.config.modules:
      path: ${path.config}/modules.d/*.yml
      reload.enabled: false
      reload.period: 10s
      output.logstash:
      hosts: [ "172.16.0.4:5043", "172.16.0.5:5043", "172.16.0.6:5043"]
      loadbalance: true
      compression_level: 0
      username: "elastic"
      password: "changeme"
      logging.level: info
      logging.to_files: true
      logging.to_syslog: false
      logging.files:
      path: /var/log/mybeat
      name: mybeat.log
      keepfiles: 10
      rotateeveybytes: 1073741824

LS config:
input {
beats {
port => "5043"
client_inactivity_timeout=>120
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.