title: I cannot find the cause of this WARN (logstash): "Invalid version of beats protocol"
body: <p>Dear Stackoverflow commmunity,</p>
  <p>I would like to know why I'm staked at this problem with logstash:</p>
  <pre><code>2021-01-20T01:02:33,444][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=&gt;9600}
  [2021-01-20T01:02:41,603][INFO ][org.logstash.beats.BeatsHandler][synlite_suricata][input_beats] [local: 10.0.100.12:5044, remote: 10.0.100.1:39666] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22
  [2021-01-20T01:02:41,614][WARN ][io.netty.channel.DefaultChannelPipeline][synlite_suricata][input_beats] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
  io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22
      at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:353) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final]
      at java.lang.Thread.run(Thread.java:834) [?:?]
  Caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22
      at org.logstash.beats.Protocol.version(Protocol.java:22) ~[logstash-input-beats-6.0.9.jar:?]
      at org.logstash.beats.BeatsParser.decode(BeatsParser.java:62) ~[logstash-input-beats-6.0.9.jar:?]
      at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
      ... 8 more
  [2021-01-20T01:02:41,637][INFO ][org.logstash.beats.BeatsHandler][synlite_suricata][input_beats] [local: 10.0.100.12:5044, remote: 10.0.100.1:39666] Handling exception: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 3
  [2021-01-20T01:02:41,639][WARN ][io.netty.channel.DefaultChannelPipeline][synlite_suricata][input_beats] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
  </code></pre>
  <p>I found similar topics, but I cannot find a clear explaination...
  <a href="https://stackoverflow.com/questions/63353894/logstash-beats-input-invalid-version-of-beats-protocol">Logstash beats input &quot;invalid version of beats protocol&quot;</a>
  <a href="https://stackoverflow.com/questions/63848536/mock-an-elk-beat-output-to-logstash-with-postman">Mock an ELK Beat output to Logstash with Postman</a></p>
  <p>I can share my config:</p>
  <p>pipelines.yml:</p>
  <pre><code>- pipeline.id: synlite_suricata
    path.config: &quot;/etc/logstash/synlite_suricata/conf.d/*.conf&quot;
  
  - pipeline.id: fallback
    path.config: &quot;/etc/logstash/fallback/conf.d/*.conf&quot;
  </code></pre>
  <p>synlite_suricata input:</p>
  <pre><code>input {
    # Beats
    beats {
      id =&gt; &quot;input_beats&quot;
      host =&gt; &quot;${SYNLITE_SURICATA_BEATS_HOST}&quot;
      port =&gt; &quot;${SYNLITE_SURICATA_BEATS_PORT}&quot;
      client_inactivity_timeout =&gt; 180
      ssl =&gt; false
      ssl_certificate_authorities =&gt; &quot;${SYNLITE_SURICATA_CACERT}&quot;
      ssl_certificate =&gt; &quot;${SYNLITE_SURICATA_BEATS_CERT}&quot;
      ssl_key =&gt; &quot;${SYNLITE_SURICATA_BEATS_KEY}&quot;
      ssl_verify_mode =&gt; &quot;peer&quot;
      ssl_peer_metadata =&gt; true
      tls_min_version =&gt; 1.2
      cipher_suites =&gt; [ &quot;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256&quot;, &quot;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384&quot; ]
  
    }
  }
  </code></pre>
  <p>and the systemd variables in /etc/systemd/system/logstash.service.d/synlite_suricata.conf:</p>
  <pre><code>[Service]
  # Synesis Lite for Suricata global configuration
  Environment=&quot;SYNLITE_SURICATA_DICT_PATH=/etc/logstash/synlite_suricata/dictionaries&quot;
  Environment=&quot;SYNLITE_SURICATA_TEMPLATE_PATH=/etc/logstash/synlite_suricata/templates&quot;
  Environment=&quot;SYNLITE_SURICATA_GEOIP_DB_PATH=/etc/logstash/synlite_suricata/geoipdbs&quot;
  Environment=&quot;SYNLITE_SURICATA_GEOIP_CACHE_SIZE=8192&quot;
  Environment=&quot;SYNLITE_SURICATA_GEOIP_LOOKUP=true&quot;
  Environment=&quot;SYNLITE_SURICATA_ASN_LOOKUP=true&quot;
  Environment=&quot;SYNLITE_SURICATA_CLEANUP_SIGS=false&quot;
  
  # Name resolution option
  Environment=&quot;SYNLITE_SURICATA_RESOLVE_IP2HOST=false&quot;
  Environment=&quot;SYNLITE_SURICATA_NAMESERVER=127.0.0.1&quot;
  Environment=&quot;SYNLITE_SURICATA_DNS_HIT_CACHE_SIZE=25000&quot;
  Environment=&quot;SYNLITE_SURICATA_DNS_HIT_CACHE_TTL=900&quot;
  Environment=&quot;SYNLITE_SURICATA_DNS_FAILED_CACHE_SIZE=75000&quot;
  Environment=&quot;SYNLITE_SURICATA_DNS_FAILED_CACHE_TTL=3600&quot;
  
  # Elasticsearch connection settings
  Environment=&quot;SYNLITE_SURICATA_ES_HOST=10.0.100.11&quot;
  Environment=&quot;SYNLITE_SURICATA_ES_USER=logstash&quot;
  Environment=&quot;SYNLITE_SURICATA_ES_PASSWD=password&quot;
  
  # Beats input
  Environment=&quot;SYNLITE_SURICATA_BEATS_HOST=10.0.100.12&quot;
  Environment=&quot;SYNLITE_SURICATA_BEATS_PORT=5044&quot;
  
  # Certs config
  Environment=&quot;SYNLITE_SURICATA_CACERT=/etc/logstash/tls/root-ca.crt&quot;
  Environment=&quot;SYNLITE_SURICATA_BEATS_CERT=/etc/logstash/tls/logstash-input-server.crt&quot;
  Environment=&quot;SYNLITE_SURICATA_BEATS_KEY=/etc/logstash/tls/logstash-input-server.pk8&quot;
  Environment=&quot;SYNLITE_SURICATA_ES_KEYSTORE=/etc/logstash/tls/logstash-elasticsearch-output-client.p12&quot;
  Environment=&quot;SYNLITE_SURICATA_ES_KEYSTORE_PASSWORD=password&quot;
  </code></pre>
  <p>I don't know how to find and information related with &quot;beat version&quot;... Logstash-oss 7.8.0</p>
  <p>Thanks, waiting for your attention</p>