Syslog To Elastic Agent To soManager To soSearch : Where to view?

[rigbyst]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

240

Storage for /

8 TB

Storage for /nsm

4 TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Syslogs are going to a linux server running the Elastic agent. I see system.syslog event.dataset but do not see any information on the syslogs that should have been forwarded. Any help on where to look would be appreciated.
Thank you!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Are you looking for what the System integration is collecting? https://docs.securityonion.net/en/2.4/elastic-fleet.html#system-endpoints-system-integration

[rigbyst]

I'm looking to see the syslogs the event should be forwarding. For example, a firewall is sending syslogs to an elastic agent. That agent forwards to the manager node. From there I don't see an event.dataset that contains the syslogs. Any ideas?

[cm-ops]

If you are ingesting them as syslog, not using an integration they will be in event.module syslog and event.dataset system.syslog.

[rigbyst]

When I look at the system.syslog I see the error.message "failed in Fleet agent final_pipeline: field [created] not present as part of path [event.created] . I need to do more research on how the elastic agent forwards syslogs to the manager.