After reboot, Palo alto Integration run partially

[ginobyte]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

200

Storage for /nsm

500Gb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

After week-end reboot, the [Logs PANW] Network Flows dashboard was empty, checking in discovery the data stream dataset we see only panw.panos.type USERID and SYSTEM, when the message is TRAFFIC type in the document thers is an error message "Provided Grok expressions do not match field value: [ ] grok" and event.kind = pipeline_error.

I've already tried to change the syslog format from PaloAlto device (from TCP to UDP and viceversa with IETF Format or BCD) without success. I didn't change anything in SO configuration or integration plugin .

Thanks in advance for any idea and help

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Under Elastic Fleet can you see if it shows there is an update available for the integration that just hasn't been applied?