No syslog events in Kibana after Manager Node Replacement

[Rennilon]

We had an issue with our manager node (distributed stack) and ended up replacing it. I needed to run setup on the sensor and search node but now I'm not seeing incoming syslog in Kibana.

I used tcpdump to verify that the syslogs are hitting the search node

Any ideas?

[InfosecGoon]

You're sending syslog from an outside system? A firewall or something?

[Rennilon]

You're sending syslog from an outside system? A firewall or something?

Yes sending from external source. UDP/514. made sure the external source is in the firewall as a syslog source.

[Rennilon]

Couldn't figure out the issue. Ended up just rebuilding the search node. Kibana is functioning properly now.