Logstash error while receiving filebeat messages

Elastic Stack Logstash
1

I have been stashing files from filebeat,

Here the file structure:

Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "statusResponse" => "PROCESSED",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "offset" => 7418246,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "module" => "Promotion",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "source" => "/opt/zoom/logs/metrics.log",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "type" => "log",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "executionTime" => 4,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "@timestamp" => 2018-07-10T14:50:29.250Z,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "event_type" => [
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [0] "promotion",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [1] "beats_input_raw_event"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: ],
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "response" => nil,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "beat" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "name" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "hostname" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "version" => "5.6.9"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "@version" => "1",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "host" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "submodule" => "BRMSServerController"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: }
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "request" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "merchant" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "name" => "SHOPDBS*",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "id" => 2168
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "marketplaceOrder" => {},
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "shippmentAddress" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "state" => "SP"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "orderItens" => [
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [0] {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "originalUnitPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "unitPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "amount" => 0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "originalPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "productId" => 0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "offername" => "Luminaria Projetor Carrossel com Melodia - Delonghi - D2866",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "price" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "categoryname" => "Decoração para Quarto do Bebê",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "sku" => 60620745,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "categoryId" => 2227
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: }
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: ]
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },

And here the error message:

[2018-07-10T12:03:06,454][INFO ][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84, from: /172.31.3.52:36596
[2018-07-10T12:03:06,455][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:375) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:342) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:325) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:255) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:246) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:877) [netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:144) [netty-all-4.1.3.Final.jar:4.1.3.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-3.1.31.jar:?]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:411) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
... 10 more

I researched, but found no clue how to solve it!

2

Wild guess: You have SSL enabled on the Filebeat side but not on the Logstash side, or vice versa.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.