Missing Pipeline zeek.analyzer

[argwfm]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

256

Storage for /nsm

256

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Receiving search node logstash warnings that the pipeline zeek.analyzer does not exist. so-elasticsearch-pipelines-list confirms that zeek.analyzer is not present/loaded. Is there an easy fix to resolve these errors?

[2023-12-08][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["create", {:_id=>nil, :_index=>"logs-zeek-so", :routing=>nil, :pipeline=>"zeek.analyzer"}, "input"=>{"type"=>"log"}, "container"=>{"id"=>"analyzer.log"}, "data_stream"=>{"namespace"=>"so", "dataset"=>"zeek", "type"=>"logs"}, "log"=>{"offset"=>23097240, "file"=>{"path"=>"/nsm/zeek/logs/current/analyzer.log"}}, "type"=>"redis-input", "elastic_agent"=>{"version"=>"8.10.4", "id"=>"", "snapshot"=>false}, "@timestamp"=>2023-12-08, "event"=>{"dataset"=>"zeek", "category"=>"network", "module"=>"zeek"}, "agent"=>{"version"=>"8.10.4", "id"=>"", "ephemeral_id"=>"", "type"=>"filebeat", "name"=>"sensor"}, "ecs"=>{"version"=>"8.0.0"}, "metadata"=>{"input"=>{"beats"=>{"host"=>{"ip"=>"172."}}}, "version"=>"8.10.4", "beat"=>"filebeat", "stream_id"=>"logfile-log.logs-zeek-logs", "type"=>"_doc", "raw_index"=>"logs-zeek-so", "pipeline"=>"zeek.analyzer", "input_id"=>"logfile-logs-zeek-logs"}, "@version"=>"1", "host"=>{"hostname"=>"sensor", "ip"=>["172."], "id"=>"", "mac"=>[], "os"=>{"version"=>"9.3", "kernel"=>"5.15.0-200.131.27.1.el9uek.x86_64", "type"=>"linux", "name"=>"Oracle Linux Server", "family"=>"redhat", "platform"=>"ol"}, "name"=>"sensor", "architecture"=>"x86_64", "containerized"=>false}, "pipeline"=>"analyzer"}], :response=>{"create"=>{"_index"=>"logs-zeek-so", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"pipeline with id [zeek.analyzer] does not exist"}}}}

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

We already have an issue for this and it will be resolved in the upcoming 2.4.40 release:
#11892