Generally this means that something that is not speaking the beats protocol is connecting to the input. Amongst the possible causes are:
- A beat with SSL enabled connecting to a beat input with SSL disabled
- A beat with SSL disabled connecting to a beat input with SSL enabled
- A port scanner (on the public internet you can be certain that folks are port scanning you, on a corporate network this may also happen)
- Someone else trying to use the same port
- In a beat configuration someone uncommented the hosts: line for the logstash output, but left output.logstash commented and output.elasticsearch uncommented, so that the beat starts talking HTTP to the beats input instead of lumberjack