# Logstash beats: 69/71 error
**URL:** https://discuss.elastic.co/t/logstash-beats-69-71-error/290708
**Category:** Logstash
**Created:** [December 1, 2021, 8:07pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708 "2021-12-01T20:07:32Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@userR](https://discuss.elastic.co/u/userR)
#### Post date: [December 1, 2021, 8:07pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708/1 "2021-12-01T20:07:33Z")
Logstash configuration:
```auto
input {
beats {
port => 9443
host => "0.0.0.0"
ssl => false
}
}
filter {
...
}
output {
...
}
stdout{}
}
```
It looks like logstash is having an issue with the beats tag as I get the following error:
```auto
Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 69
```
```auto
Handling exception: io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71 (caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71)
```
I haven't set up filebeat but I know in the past that logstash should still work without filebeat running. Any help would be much appreciated
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 1, 2021, 8:14pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708/2 "2021-12-01T20:14:38Z")
Those message normally indicate that you have something trying to connect to the port that you configured without using the beats protocol.
Since you said that you haven't set upt filebeat yeat, you probably have something else sending messages to this port in your logstash server using a another protocol, you need to check it with a tcpdump for example.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 1, 2021, 8:18pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708/3 "2021-12-01T20:18:55Z")
> [@userR](#):
>
> `InvalidFrameProtocolException: Invalid version of beats protocol: 69`
Generally this means that something that is not speaking the beats protocol is connecting to the input. Amongst the possible causes are:
1. A beat with SSL enabled connecting to a beat input with SSL disabled
2. A beat with SSL disabled connecting to a beat input with SSL enabled
3. A port scanner (on the public internet you can be certain that folks are port scanning you, on a corporate network this may also happen)
4. Someone else trying to use the same port
5. In a beat configuration someone uncommented the hosts: line for the logstash output, but left output.logstash commented and output.elasticsearch uncommented, so that the beat starts talking HTTP to the beats input instead of lumberjack
---
### Author:  [@userR](https://discuss.elastic.co/u/userR)
#### Post date: [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708/4 "2021-12-01T20:55:04Z")
Thank you both! I did try running:
```auto
tcpdump -nnSX port 9443
```
And was returned an empty result. (I have logstash stopped at the moment)
@Badger, it's not 1-2 or 5 as I don't have filebeat set up
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2021, 8:55pm UTC](https://discuss.elastic.co/t/logstash-beats-69-71-error/290708/5 "2021-12-29T20:55:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.