Fleet final pipeline errors

[Sahale]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello!

2.4.60, in logs from Win agents we get "error.message" with values like "failed in Fleet agent final_pipeline: Text '2024-04-17T13:14:03.808Z' could not be parsed at index 20".
We checked ".fleet_final_pipeline-1" and it looks like error in

  {
    "date": {
      "if": "ctx.event?.module == 'system'",
      "field": "event.created",
      "target_field": "@timestamp",
      "formats": [
        "yyyy-MM-dd'T'HH:mm:ss.SSSSSS'Z'"
      ]
    }
  }

because correct timestamp is "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'".
This pipeline is managed one, so question is: can we fix it by editing pipeline or we should wait for fix?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Can you provide any screenshots for what you're seeing in SOC?

[Sahale]

I'm sorry, but I didn't get what specific screenshots you need.
Anyway, screenshot from Elastic and SOC Grid.

Elastic:

Node status:

We know about high IOwait on this node, but we got same errors from nodes with normal IOwait.

[reyesj2]

That error will be fixed with #12881