{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/44","repository_url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/44/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/44/events","html_url":"https://github.com/logstash-plugins/logstash-input-beats/issues/44","id":126858867,"number":44,"title":"Beats Input: Remote connection closed unsupported protocol 42 warning","user":{"login":"MarkGoldsmith1987","id":8806637,"avatar_url":"https://avatars.githubusercontent.com/u/8806637?v=3","gravatar_id":"","url":"https://api.github.com/users/MarkGoldsmith1987","html_url":"https://github.com/MarkGoldsmith1987","followers_url":"https://api.github.com/users/MarkGoldsmith1987/followers","following_url":"https://api.github.com/users/MarkGoldsmith1987/following{/other_user}","gists_url":"https://api.github.com/users/MarkGoldsmith1987/gists{/gist_id}","starred_url":"https://api.github.com/users/MarkGoldsmith1987/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarkGoldsmith1987/subscriptions","organizations_url":"https://api.github.com/users/MarkGoldsmith1987/orgs","repos_url":"https://api.github.com/users/MarkGoldsmith1987/repos","events_url":"https://api.github.com/users/MarkGoldsmith1987/events{/privacy}","received_events_url":"https://api.github.com/users/MarkGoldsmith1987/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2016-01-15T11:52:38Z","updated_at":"2016-03-17T16:29:02Z","closed_at":null,"body":"I'm seeing this filling up my logstash log:\r\n\r\n{:timestamp=>\"2016-01-15T11:46:37.690000+0000\", :message=>\"Beats Input: Remote connection closed\", :peer=>\"xx.xx.xx.xx:41919\", :exception=>#<Lumberjack::Beats::Connection::ConnectionClosed: Lumberjack::Beats::Connection::ConnectionClosed wrapping: Lumberjack::Beats::Parser::UnsupportedProtocol, unsupported protocol 42>, :level=>:warn}\r\n\r\nPrior to upgrading to the latest version of the logstash-input-beats plugin with was being reported as an error, however since upgrading the logs from filebeat are being processed by its completely spamming the logstash.log file with these warnings.\r\n\r\nVersions\r\nFilebeats 1.0.1\r\nLogstash-input-beats  2.1.2\r\nLogstash: 2.1.1"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/comments/197961132","html_url":"https://github.com/logstash-plugins/logstash-input-beats/issues/44#issuecomment-197961132","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-input-beats/issues/44","id":197961132,"user":{"login":"jerrac","id":910764,"avatar_url":"https://avatars.githubusercontent.com/u/910764?v=3","gravatar_id":"","url":"https://api.github.com/users/jerrac","html_url":"https://github.com/jerrac","followers_url":"https://api.github.com/users/jerrac/followers","following_url":"https://api.github.com/users/jerrac/following{/other_user}","gists_url":"https://api.github.com/users/jerrac/gists{/gist_id}","starred_url":"https://api.github.com/users/jerrac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jerrac/subscriptions","organizations_url":"https://api.github.com/users/jerrac/orgs","repos_url":"https://api.github.com/users/jerrac/repos","events_url":"https://api.github.com/users/jerrac/events{/privacy}","received_events_url":"https://api.github.com/users/jerrac/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T16:29:02Z","updated_at":"2016-03-17T16:29:02Z","body":"So, after looking at the topbeat.yml file my coworker sent me, I found that he was trying to send elasticsearch data to my logstash indexer... He hadn't uncommented the ```#logstash:``` line. Which gave him something like this:\r\n```yaml\r\noutput:\r\n  elasticsearch:\r\n    hosts: [\"localhost:9200\"]\r\n    hosts: [\"indexer:5043\"]\r\n```\r\n\r\nThat would explain the protocol error, right?\r\n\r\nHe hasn't fixed it yet, so I can't confirm on my own.\r\n"}}