Logstash BeatsParser$InvalidFrameProtocolException - elasticsearch

Question

i have filebeat version 1.3.1 (amd64)
and logstash 6.3.2
Ok so i was getting ssl error at filebeat host ,
Feb 14 17:26:49 dca-cos1-v-ap002 /usr/bin/filebeat[21994]: transport.go:125: SSL client failed to connect with: dial tcp i/o timeout
So i delete tls section from filebeat.yml and in logstash.yml i set ssl => false
Now im geeting this error:
Error below:
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: [2020-02-14T17:38:03,066][INFO ][org.logstash.beats.BeatsHandler] [local: 10.48.1.216:5044, remote: 10.48.1.218:45104] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 1
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: [2020-02-14T17:38:03,066][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 1
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:392) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:342) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 1
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.0.16.jar:?]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:38:03 PLEUDTLOG01 logstash[8099]: ... 10 more
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: [2020-02-14T17:39:03,066][INFO ][org.logstash.beats.BeatsHandler] [local: 10.48.1.216:5044, remote: 10.48.1.218:45106] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: [2020-02-14T17:39:03,067][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 3
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Feb 14 17:39:03 PLEUDTLOG01 logstash[8099]: at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
Any idea what im doing wrong?
this logstash and filebeat was working some time ago

Answer 1

This I have also faced and here is solution.
You need to specify the right input in the Logstash pipleline.
for example if you are using filebeat then use following:
input {
beats {
port => 5044
}
}
If you are using the TCP for the springboot or any live feed then use
input {
tcp {
port => 5043
codec => "json_lines"
}
}
if you are sending both then configure both.
input {
tcp {
port => 5043
codec => "json_lines"
}
beats {
port => 5044
}
}