# Lumberjack Beats Connection ConnectionClosed in logstash 2.2

**URL:** <https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660>\
**Category:** Logstash\
**Created:** [April 28, 2016, 9:52am UTC](https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660 "2016-04-28T09:52:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [April 28, 2016, 9:52am UTC](https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660/1 "2016-04-28T09:52:43Z")

</div>

Hi ,  
I am running the LS-shipper on 5000 port.

```
input {
beats {
  port=>"5000"
  ssl_certificate => "/opt/logstash-elk/SSL/hostName.lij.fi.cer"
  ssl_key => "/opt/logstash-elk/SSL/logstash.key"

}
}

```

When I conect using curl [http://LSHostName:5000](http://LSHostName:5000) it says, curl: (52) Empty reply from server, means it connects.

As soon as I start the FB, Shipper starts writing below logs.

`{:timestamp=>"2016-04-28T12:04:57.175000+0300", :message=>"Beats Input: Remote connection closed", :peer=>"10.xxx.x.xxx:50932", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Lumberjack::Beats::Parser::UnsupportedProtocol, unsupported protocol 22>, :level=>:warn}`  
I am not able to understand the reason behind this.

Sometime it seems chicken and age situation.

When filebeat is stopped, LS says connection closed. Is it like LS stopped at the moment? If Yes then how could FB will make connection with LS when its stopped? Thats why I am saying its chicken and egg situation.

**NOTE: this happens only when I enable tsl mode from FB. Otherwise it connects properly.**

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 30, 2016, 3:23pm UTC](https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660/2 "2016-04-30T15:23:02Z")

</div>

Add `ssl => true` to your beats input.

---

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [May 2, 2016, 6:07am UTC](https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660/3 "2016-05-02T06:07:52Z")

</div>

Thank you Magnus. It works 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/lumberjack-beats-connection-connectionclosed-in-logstash-2-2/48660/4 "2017-07-06T04:59:43Z")

</div>

Closed on July 6, 2017, 4:59am UTC