# org.logstash.beats.InvalidFrameProtocolException
**URL:** https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception/229862
**Category:** Logstash
**Created:** [April 26, 2020, 6:17pm UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception/229862 "2020-04-26T18:17:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)
#### Post date: [April 26, 2020, 6:17pm UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception/229862/1 "2020-04-26T18:17:41Z")
Looks like logstash is receving incorrect event type, that's due to beats on remote machines mis-configuration, we have hundreds of remote machines,
is there any possible way to extrac the **remote: 172.16.234.66** inofmration from the error.
Then we'll be able to indentify the target machines? The problem is this message not get into the logstash pipelines.
```auto
[2020-04-26T18:08:00,250][INFO][org.logstash.beats.BeatsHandler][xxx] [local: 0.0.0.0:50996, remote: 172.16.234.66] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
[2020-04-26T18:08:00,253][INFO][org.logstash.beats.BeatsHandler][xxxx] [local: 0.0.0.0:50996, remote: 172.16.234.66] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
[2020-04-26T18:08:00,254][WARN][io.netty.channel.DefaultChannelPipeline][xxxx]An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_252]
Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 71
at org.logstash.beats.Protocol.version(Protocol.java:22) ~[logstash-input-beats-6.0.9.jar:?]
at org.logstash.beats.BeatsParser.decode(BeatsParser.java:62) ~[logstash-input-beats-6.0.9.jar:?]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
```
---
### Author:  [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)
#### Post date: [April 28, 2020, 8:51pm UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception/229862/2 "2020-04-28T20:51:34Z")
hmm~ , figured out myself, I can use the filebeat to collect the logstash log with the logstash module. 😀
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 26, 2020, 8:51pm UTC](https://discuss.elastic.co/t/org-logstash-beats-invalidframeprotocolexception/229862/3 "2020-05-26T20:51:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.