Seeing logs in the hunt dashboard, but not in Kibana

[beetoljooce]

Per what it states in the title. I have it set up to ship firewall logs to SO 2.4 from a firewall via syslog. They show up in the dashboard in the main dashboards, but don't see anything in Kibana. The port is set to UDP, but I have integrations for reception over 514 with UDP.

Running a Distributed environment, shipping to a heavynode in a low throughput environment.

[cm-ops]

Do you see the heavynodes in cluster settings? sudo so-elasticsearch-query _cluster/settings?pretty

[beetoljooce]

It seems attached to the cluster. This is what is returned from my manager:

{
"persistent" : {
"cluster" : {
"remote" : {
"[Manager_Here]" : {
"seeds" : [
"127.0.0.1:9300"
]
},
"[Minion_Here]" : {
"seeds" : [
"[internal_IP]:9300"
]
}
}
}
},
"transient" : { }
}

Those fields are empty on my heavynode.

[cm-ops]

Are you running a manager or managersearch? Just so I am clear, you see logs from both servers in SOC > Hunt, but nothing in Kibana?

[beetoljooce]

The master is a managersearch. I am seeing logs, both system and shipped from my agent, in the SOC > Hunt, and not Kibana - correct.

[cm-ops]

SOC and Kibana are both querying Elasticsearch for the data. Do you see any issues/errors in the /opt/so/log/kibana/kibana.log?

If you go into Discover are you able to query for logs?

[beetoljooce]

Kibana logs have two error fields with TypeError: Cannot read properties of undefined. I can query system logs (ie. system.syslog). I did notice an update from the version I was at (2.4.4) to 4.6, with the container metrics, that so-elastic-agent is missing. I've tried manually starting it and running docker-refresh on my manager, but it seems to just not... be there?

Also, thank you for the help. I am learning this as I go.