# Logstash not recording beats from remote systems

**URL:** https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768
**Category:** Beats
**Created:** [August 2, 2018, 1:06pm UTC](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768 "2018-08-02T13:06:17Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![nansari](https://avatars.discourse-cdn.com/v4/letter/n/f04885/32.png) [@nansari](https://discuss.elastic.co/u/nansari)
#### Post date: [August 2, 2018, 1:06pm UTC](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768/1 "2018-08-02T13:06:17Z")

</div>

My Logstash 6+ is able to parse and show logs from various beats running on the same server, however it is not showing me logs from any remote systems. I have verified connectivity to port 5044. In the Logstash logs, i see the following INFO and warning messages.:

[2018-08-01T00:00:13,666][INFO][org.logstash.beats.BeatsHandler] [local: 10.75.10.59:5044, remote: 10.75.10.249:47012] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69  
[2018-08-01T00:00:14,808][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.  
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]  
at java.lang.Thread.run(Unknown Source) [?:1.8.0\_171]  
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69  
at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.13.jar:?]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]  
... 8 more

Any ideas how this can be fixed? Thanks in advance.

---

<div class="post-metadata">

### Author: ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [August 2, 2018, 1:22pm UTC](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768/2 "2018-08-02T13:22:29Z")

</div>

Hi,

can you please report both your Beats and Logstash configurations?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2018, 3:22pm UTC](https://discuss.elastic.co/t/logstash-not-recording-beats-from-remote-systems/142768/3 "2018-08-30T15:22:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
