Support Questions
Find answers, ask questions, and share your expertise

ListenBeats - Multiple errors

ListenBeats - Multiple errors

Explorer

nifi-1.3.0 - RedHat 7.3

When I set up a ListenBeats Processor, it keeps throwing errors

  • [BeatsFrameException: Error Decoding Beats frame:...] sometimes the reason is `invalid distance too far back`, or `Unexpected end of ZLIP input stream`.
    • It correctly decodes very few log entries (like 1 out of 500) ... but the rest are not properly decoded with the above mentioned errors.
  • Another error [Error sending response for transaction 1 due to null: java.nio.channels.ClosedChannelException]
    • The beat sources does NOT consider the log entries sent to NiFi as delivered ... i.e. when I stop ListenBeats and bring up logstash, the improperly parsed events are actually being sent to logstash by the beats senders.

The beats sending the logs are version 5.3.2 (winlogbeat, filebeat and packetbeat).

1 REPLY 1

Re: ListenBeats - Multiple errors

New Contributor

I have all the same issues. Any news on a fix or solution?