Logstash.log netty.handler SSL/TLS error

[endpointsec]

Logstash's beat input is set to use a TLS cert. Winlogbeat is showing a successful handshake to the server:

PS C:\Program Files\Elastic\Beats\7.9.3\winlogbeat> .\winlogbeat.exe test output -c C:\ProgramData\Elastic\Beats\winlogbeat\winlogbeat.yml logstash: SO_IP:5044... connection... parse host... OK dns lookup... OK addresses: SO_IP dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.2 dial up... OK talk to server... OK

However, /opt/so/log/logstash/logstash.log has a recurring error with several varying values following this message. Sysmon logs do not populate in the index.

Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record:

A wireshark capture shows TLS 1.2 data headed to the onion IP. Not sure how to further look into this as all services are OK.

[endpointsec]

This issue may be closed. Another client not using the certificate was pumping data into it.