Open kares opened 2 years ago
I'm seeing the same error today when trying to follow these instructions to send data from logstash to logstash using lumberjack to beats: https://www.elastic.co/guide/en/logstash/8.2/ls-to-ls-lumberjack.html
Error on the sending side:
WARNING: Failed to load native protocols db
java.lang.RuntimeException: getprotobyname_r failed
at jnr.netdb.NativeProtocolsDB$LinuxNativeProtocolsDB.getProtocolByName(NativeProtocolsDB.java:180)
at jnr.netdb.NativeProtocolsDB.load(NativeProtocolsDB.java:80)
...
[2022-05-24T21:23:37,884][ERROR][logstash.outputs.lumberjack][main] All hosts unavailable, sleeping {:hosts=>[...
Error on the receiving side:
[2022-05-24T21:23:37,848][INFO ][org.logstash.beats.BeatsHandler][beats][ae5c2442aab1062649e3de2da65fa67b910e91835a49b7e9331460b49a5b5122] [local: 192.168.98.7:5044, remote: 10.126.233.171:38970] Handling exception: io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22 (caused by: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22)
Could be unrelated to your bug, kares - but this was the only web search result for getprotobyname_r failed
.
Logstash version is 8.2.0 on both sides.
while the warning is present JNR (and thus Logstash) seems to be working fine.
your issue is not caused by what the issue report here is about but is rather smt is sending unexpected payload on the receiving input: io.netty.handler.codec.DecoderException: org.logstash.beats.InvalidFrameProtocolException: Invalid version of beats protocol: 22
... the protocol expected a specific format but got a different byte - likely smt else tried connecting to the port.
Oh, thanks for parsing that for me! Ok, I'll look more closely at the codecs I'm using, etc.
This will be fixed by adding the netbase package to the Docker image.
USER root
RUN apt install netbase -y
hitting a code path which executes
Socket.tcp_server_sockets(address, port)
exposes a JNR bug.NOTE: for now only seen this fail in tests (usually when WEBrick is used), the failure is intermittent at times.
sample reproducer
docker run -it --entrypoint "/bin/bash" docker.elastic.co/logstash/logstash:7.17.0
/usr/share/logstash/bin/ruby -rsocket -e "p Socket.tcp_server_sockets('127.0.0.1', 3000)"
:boom: This code path is triggered e.g. whenWEBrick::HTTPServer.new
gets executed./usr/share/logstash/bin/ruby -v
Using bundled JDK: /usr/share/logstash/jdk jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]
/usr/share/logstash/bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk
logstash 7.17.0
uname -a
Linux 3e79a29191ae 5.4.0-92-generic #103-Ubuntu SMP Fri Nov 26 16:13:00 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
cat /etc/lsb-release
Running the same against:
docker run -it --entrypoint "/bin/bash" docker.elastic.co/logstash/logstash:7.16.3
seems to work just fine:/usr/share/logstash/bin/ruby -rsocket -e "p sockets = Socket.tcp_server_sockets('127.0.0.1', 3000)"
Using bundled JDK: /usr/share/logstash/jdk [#<ServerSocket:fd 7>]
/usr/share/logstash/bin/ruby -v
Using bundled JDK: /usr/share/logstash/jdk jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.13+8 on 11.0.13+8 +indy +jit [linux-x86_64]
/usr/share/logstash/bin/logstash --version
Using bundled JDK: /usr/share/logstash/jdk logstash 7.16.3
uname -a
Linux 393d094500c8 5.4.0-92-generic #103-Ubuntu SMP Fri Nov 26 16:13:00 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
cat /etc/redhat-release