2.4.50 Upgrade - Missing Items/Elasticsearch Pending

[arisentow]

I upgraded my 2.4.40 standalone to 2.4.50 via soup today and am not seeing the new features listed on the latest blog post, to include:

• "Connections and Metadata with community_id" and "Connections seen by Zeek or Suricata" dashboards
• Process Ancestors actions (when working with something process related)

Additionally, my previous 2.4.40 installation had the issue where elasticsearch was always "pending". It was temporarily fixed with #12302 however the issue came back after a few days. I was hoping it would be fixed with 2.4.50, however after the upgrade it is still there.

Any ideas?

[cm-ops]

Did that index roll over and create a replica shard again?

[weslambert]

Try adding a period to the start of the index pattern for the diagnostic template in /opt/so/saltstack/default/salt/elasticsearch/defaults.yaml

https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/dev/salt/elasticsearch/defaults.yaml#L3929

[arisentow]

Do I need to run the fix first or anything? Also, after adding the period, do I run a salt-call?

[sleepingbel]

Hello Wes i had the same problem after a reboot today, but if i check the defaults.yaml it is the same as in github.

[weslambert]

The period change I mentioned will be in the next release. The template in 2.4.50 was assumed to fix the issue, but it didn't.

You'll want to make the change to the defaults file with the period, then restart Elasticsearch.

You can then check the template to see if it has been updated. The change to the replicas only affects indices that are already created. Assuming the template is updated, new indices should use 0 replicas.

[arisentow]

@weslambert I made the change above, and am still seeing "pending". Do I need to run one of the fixes to remove to old replicas? Also, while elasticsearch is in the pending status, is it actually affecting any functionality? I haven't noticed any glaring issues.