# Winlogbart 6.0.1- Logstash beats parser error

**URL:** <https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484>\
**Category:** Logstash\
**Created:** [February 12, 2018, 2:41pm UTC](https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484 "2018-02-12T14:41:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 12, 2018, 2:41pm UTC](https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484/1 "2018-02-12T14:41:56Z")

</div>

Hi All,

Iam trying to send the windows events using winlogbeat to logstash, all the four components have 6.0.1 version.

Logstash conf

```auto

input {
  beats {
    port => 5547
    tags => "windows"
  }
}

output {
    if ( "windows" in [tags] ) {
    elasticsearch {
      index => "winlogbeat-%{+YYYY.MM.dd}"
       hosts => ["https://localhost:9200"]
      cacert => '/usr/share/elasticsearch/bin/x-pack/ca/ca.crt'
      ssl_certificate_verification => false
      ssl => true
      user => "xxxx"
      password => "xxx"
     }
  }
}

```

Am getting this message in logstash-plain.log

```auto
[2018-02-12T09:26:00,366][INFO][logstash.inputs.metrics] Monitoring License OK
[2018-02-12T09:26:05,797][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5547, remote: x.x.x.x:53209] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69
[2018-02-12T09:26:05,800][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5547, remote: x.x.x.x:53209] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84

```

Am not sure whats the mistake,I have made please do let me know to fix this issue.  
Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 13, 2018, 7:54am UTC](https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484/2 "2018-02-13T07:54:03Z")

</div>

What does your Winlogbeat configuration look like? Make sure you format the YAML as preformatted text so we can see the exact formatting.

---

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [February 13, 2018, 8:29am UTC](https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484/3 "2018-02-13T08:29:58Z")

</div>

Sure thanks Magnus , I will look in to that

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2018, 8:30am UTC](https://discuss.elastic.co/t/winlogbart-6-0-1-logstash-beats-parser-error/119484/4 "2018-03-13T08:30:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.