# Unable configure ELK stack on Single Node

**URL:** <https://discuss.elastic.co/t/unable-configure-elk-stack-on-single-node/368329>\
**Category:** Logstash\
**Created:** [October 7, 2024, 7:54am UTC](https://discuss.elastic.co/t/unable-configure-elk-stack-on-single-node/368329 "2024-10-07T07:54:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PJ111288](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pj111288/32/98119_2.png) [@PJ111288](https://discuss.elastic.co/u/PJ111288)\
**Post date:** [October 7, 2024, 7:54am UTC](https://discuss.elastic.co/t/unable-configure-elk-stack-on-single-node/368329/1 "2024-10-07T07:54:44Z")

</div>

Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 3

-Config :  
No xpack secuirty enabled  
cd /etc/logstash/conf.d/

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
if [type] == "syslog" {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
syslog\_pri { }  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
}  
}

* * *

filebeat version 8.15.1  
elasticsearch Version: 8.15.2  
logstash Version 8.15.2  
kibana Version 8.15.2

what could be issue?

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [October 7, 2024, 11:56am UTC](https://discuss.elastic.co/t/unable-configure-elk-stack-on-single-node/368329/2 "2024-10-07T11:56:06Z")

</div>

HI @PJ111288, I would highly recommend if you can format your code so that it will be easy to understand. Few question -

1. Is it warning or error?
2. Do you getting any error on filebeat?
3. Could you just print stdout on your logstash and see if you're receiving proper data?
4. Hows your filebeat config looks like?