Alert - grouped by Sensor, source IP/Port, Destination IP/Port, Name - Error 500

[rserio]

Version

2.4.60

Installation Method

Other (please provide detail below)

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

32GB

Storage for /

500G

Storage for /nsm

500G

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have a distributed version of SOC, I use the image to make the manager-node, I have a forward sensor (hardware with net-installed on oracle RHEL) and a IDH (VM) when I try to sort Alerts by Sensor, Source IP/Port, Destination IP/Port, Name I get a failed status code 500, I have attached a screenshot.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Do you have a search node? If you run this command on your manager what returns - sudo so-elasticsearch-query _cluster/health?pretty

[rserio]

Yes it is the manager/search node and it does return

sudo] password for soc-root:
{
"cluster_name" : "securityonion",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 89,
"active_shards" : 89,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
soc-root@so-manager>

[InfosecGoon]

What is the output from "sudo so-elasticsearch-indices-list"?

[rserio]

looks like all green and open.