Unknown beats protocol version

Hi all,
I have a problem during Exchange ingestion using GELF TCP input.
Sometimes I have this errors in the graylog log:

2021-03-30 17:12:18,102 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [Beats/5f8d9d1cc713ac0022401271] (channel [id: 0x0a0f0731, /10.244.1.0:43488 => /10.244.0.46:5044])
java.lang.Exception: Unknown beats protocol version: 71
at org.graylog.plugins.beats.BeatsFrameDecoder.checkVersion(BeatsFrameDecoder.java:163) ~[?:?]

2021-03-30 17:12:18,119 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [Beats/5f8d9d1cc713ac0022401275] (channel [id: 0xb31f742c, /10.244.1.0:45212 :> /10.244.0.46:5045])
java.lang.Exception: Unknown beats protocol version: 69

With them I have also strange errors about jackson Json perser exception like

2021-03-30 17:16:49,965 ERROR: org.graylog2.inputs.codecs.GelfCodec - Could not parse JSON, first 400 characters: 
com.fasterxml.jackson.core.JsonParseException: Illegal character ((CTRL-CHAR, code 1)): only regular white space (\r, \n, \t) is allowed between tokens
at [Source: ; line: 1, column: 2] ← CTRL-CHAR with code 8 too

2021-03-30 17:16:49,965 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=b6d85d50-917b-11eb-9560-0af629b282c1, journalOffset=4703247, codec=gelf, payloadSize=3, timestamp=2021-03-30T17:16:49.957Z, remoteAddress=/10.244.2.0:39942}
com.fasterxml.jackson.core.JsonParseException: Unexpected character (‘�’ (code 65533 / 0xfffd)): expected a valid value (number, String, array, object, ‘true’, ‘false’ or ‘null’)
at [Source: ��; line: 1, column: 2]

that give me the final error:

2021-03-30 17:16:49,965 ERROR: org.graylog2.plugin.inputs.transports.NettyTransport - Error in Input [GELF TCP/5f8d9d1cc713ac0022401246] (channel [id: 0x0c3659c8, /10.244.2.0:39942 :> /10.244.0.46:12201])
java.lang.IllegalStateException: GELF message is too short. Not even the type header would fit.

What i should check? After this errors Graylog stop to work and I need to restart it.
I’m using Graylog 2.5.2

The Exchange data are sending via LogStash into GELF input
Thanks very much to those who want to help me

Hi,

It seems like incompatible versions between Graylog and Logstash.

Have you ever consider update your Graylog version?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.