Graylog2 / Graylog2/graylog2-server

More information in "Unknown beats protocol X"-exception

Open
#4,763 3 comments 0 reactions 0 assignees View on GitHub
improvement papercut triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

I have some beats with "Unknown" protocol version that Graylog 2.4.3 does not understand.
I need some more information of the beat sending agent displayed and reduced output in the logs. All this if possible.

## Current Behavior

Current behaviour is like this:
2018-04-26T11:14:42.793+02:00 ERROR [NettyTransport] Error in Input [Beats/5ad61f82a3f2bb438c2d992a] (channel [id: 0x6a2af37f, /remote:port :> /graylognode:port])
java.lang.Exception: Unknown beats protocol version: 3

I have the input behind a load balancer and the address in the error message is showing the load balancers ip.

## Possible Solution

If the information can be found in the received message about who actually is sending this unknown beat protocol it would be nice to have it displayed. It's not that very helpful to know which load balancer is relaying the message.
I hope this is possible to do otherwise I'll have to live with it.

It would also be nice to see if the java stack dump about "unknown beat protocol" could be masked out to only show an error. This to decrease number of rows written to log.

## Steps to Reproduce (for bugs)
no steps given

## Context

## Your Environment
Graylog with different beat versions sending data from clients.
Beats is sent to a load balanced address and relayed to graylog nodes.

* Graylog Version: 2.4.3
* Elasticsearch Version: 5.6.8
* MongoDB Version: 2.6.10
* Operating System: Ubuntu 16.04
* Browser version: not needed

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.