Unable to load custom logstash config on master

[SliuzasLukas]

Hello,

I've been working on loading a custom Rita Logstash configuration for the past few days, following the guidelines outlined in the Security Onion documentation (https://docs.securityonion.net/en/2.3/logstash.html#adding-new-logs).

While I've successfully implemented this on a standalone setup, I'm encountering issues when attempting to replicate the process on the Security Onion manager distribution. Specifically, the expected outcome is the creation of a search folder in the /opt/so/conf/logstash/pipelines directory, but this isn't happening. I'm uncertain about what might be causing this discrepancy. Could you provide insights into any potential missteps I might be making in this process?