Unknown beats protocol version: 22, 3, 71, 69

Elastic Stack Beats
, ,
1

Hello, I am new to Elasticsearch and Graylog. I have implemented Beats (filebeat heartbeat and metricbeat) on Remote Nomad cluster. I am shipping logs and metric to a centralised server. Everything seems to work fine until I encountered with this error.

Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0x6ae4d106, L:/172.27.0.4:5044 ! R:/10.142.3.97:33394]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:01:08,737 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0x6ae4d106, L:/172.27.0.4:5044 ! R:/10.142.3.97:33394]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:02:00,181 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xb16d8fbf, L:/172.27.0.4:5044 ! R:/10.142.3.97:33492]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:02:00,182 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xb16d8fbf, L:/172.27.0.4:5044 ! R:/10.142.3.97:33492]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:02:51,222 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xff6c3305, L:/172.27.0.4:5044 ! R:/10.142.3.97:33588]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:02:51,222 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xff6c3305, L:/172.27.0.4:5044 ! R:/10.142.3.97:33588]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:03:50,868 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0x1feedc93, L:/172.27.0.4:5044 ! R:/10.142.3.97:33700]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:03:50,868 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0x1feedc93, L:/172.27.0.4:5044 ! R:/10.142.3.97:33700]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:04:21,675 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xc777ace6, L:/172.27.0.4:5044 ! R:/10.142.3.97:33768]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:04:21,675 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xc777ace6, L:/172.27.0.4:5044 ! R:/10.142.3.97:33768]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:04:59,062 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xcc0387cd, L:/172.27.0.4:5044 ! R:/10.142.3.97:33836]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)
graylog_1 | 2022-03-25 20:04:59,062 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0xcc0387cd, L:/172.27.0.4:5044 ! R:/10.142.3.97:33836]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 3)
graylog_1 | 2022-03-25 20:05:37,214 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Beats/623e1f6f06d36604070d9aee] (channel [id: 0x27d1622d, L:/172.27.0.4:5044 ! R:/10.142.3.97:33914]) (cause io.netty.handler.codec.DecoderException: java.lang.IllegalStateException: Unknown beats protocol version: 22)

Currently I am using
Beats: 7.10.2
Elasticsearch: 7.10.2
Graylog: 4.2.7

I am not using Logstash. Logs are directly shipped to Graylog server. TLS is disabled on both side. Can someone please help me.

2

Hello,

Graylog is not supported here as it is a third-party tool, you will need to check with a Graylog community.

Logstash sometimes throws a similar error that means that you have some client sending data to the beats input port without using the beats protocol, maybe you should check if this isn't the case with your Graylog.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.