Logstash error while receiving filebeat messages

I have been stashing files from filebeat,

Here the file structure:

Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "statusResponse" => "PROCESSED",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "offset" => 7418246,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "module" => "Promotion",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "source" => "/opt/zoom/logs/metrics.log",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "type" => "log",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "executionTime" => 4,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "@timestamp" => 2018-07-10T14:50:29.250Z,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "event_type" => [
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [0] "promotion",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [1] "beats_input_raw_event"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: ],
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "response" => nil,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "beat" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "name" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "hostname" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "version" => "5.6.9"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "@version" => "1",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "host" => "prod-zpromotion1d",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "submodule" => "BRMSServerController"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: }
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "request" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "merchant" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "name" => "SHOPDBS*",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "id" => 2168
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "marketplaceOrder" => {},
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "shippmentAddress" => {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "state" => "SP"
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "orderItens" => [
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: [0] {
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "originalUnitPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "unitPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "amount" => 0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "originalPrice" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "productId" => 0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "offername" => "Luminaria Projetor Carrossel com Melodia - Delonghi - D2866",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "price" => 0.0,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "categoryname" => "Decoração para Quarto do Bebê",
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "sku" => 60620745,
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: "categoryId" => 2227
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: }
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: ]
Jul 10 11:50:32 prod-es-ingest1e logstash[1061]: },

And here the error message:

[2018-07-10T12:03:06,454][INFO ][org.logstash.beats.BeatsHandler] Exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84, from: /172.31.3.52:36596
[2018-07-10T12:03:06,455][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:375) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:342) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:325) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:255) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:246) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:877) [netty-all-4.1.3.Final.jar:4.1.3.Final]
at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:144) [netty-all-4.1.3.Final.jar:4.1.3.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-3.1.31.jar:?]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:411) ~[netty-all-4.1.3.Final.jar:4.1.3.Final]
... 10 more

I researched, but found no clue how to solve it!

Wild guess: You have SSL enabled on the Filebeat side but not on the Logstash side, or vice versa.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.