Request failed with status code 502

[attinaibhayo]

Hi,
We have the following setup of SO in our infrastructure:

• Security Onion version : 2.3.260
• It is on-prem and have internet access
• Installed SO from ISO Image
• OS is CentOS.
• We have one node.
• So-status is showing all the services running.
• No failure detected from "sudo salt-call state.highstate" command.
• Grid is showing the following :
  Online Since: Jul 7, 2023 11:40 PM
  Production EPS: 1,069
  Consumption EPS: 2,135
  Process Status: OK
  Connection Status: OK
  Raid Status: unknown

Issue:

I am getting "Request failed with status code 502" in alert dashboard of security onion. Can you please help me out.

[InfosecGoon]

Check the logs in /opt/so/log/soc/sensoroni-server.log and /opt/so/log/elasticsearch/*.log, that error usually means that an error was returned from Elasticsearch when you made your query.

Solutions for many of these errors are on the Elasticsearch page in our docs: https://docs.securityonion.net/en/2.3/elasticsearch.html

[attinaibhayo]

Thanks for the response. I was able to solve the issue after deleting the old index.

[jrmsq]

@attinaibhayo I have been having a similar issue. When you say old index, is anyone specific? If you don't mind sharing exactly what you did?

[attinaibhayo]

Hi,
Yes, the one which was causing the issue. I check the error through cluster health from dev tool.