Grid only shows manager node and no logs/alerts visible in Fleet or Elastic – need help

[abcd123chamara]

Hi team,

I’ve recently set up a distributed Security Onion deployment, including:

• Manager node
• Search node
• Forward nodes (sensors)

All the nodes are accepted in the Administration → Grid Members section and showing all as "Accepted."
However, I’ve noticed a couple of issues:

1. In the Grid section, only the manager node is visible. The search and forward nodes are not listed.
2. In Fleet, I can see two hosts:
   - securityonion
   - fleet-server-securityonion

Both show recent "Last activity" timestamps (a few seconds ago), but no logs or alerts are visible in:
- Discover (Kibana)
- Alerts
- Dashboards

It looks like the agents are running, but no data is being collected or forwarded properly.
Can anyone help me figure out what I might be missing or what to check?

Thanks in advance!

[cm-ops]

Do you see all the nodes check in when you run sudo salt \* test.ping? If so, are all node time synchronized? You can check from the manager with sudo salt \* system.get_system_date_time.

If there is no logging, check the manager's Logstash log to see if there is any issues /opt/so/log/logstash/logstash.log

[abcd123chamara]

Do you see all the nodes check in when you run sudo salt \* test.ping? If so, are all node time synchronized? You can check from the manager with sudo salt \* system.get_system_date_time.

If there is no logging, check the manager's Logstash log to see if there is any issues /opt/so/log/logstash/logstash.log

Yes I can see all nodes when i run this command "sudo salt * system.get_system_date_time"

[cm-ops]

Are all the nodes time synchronized?

[abcd123chamara]

Are all the nodes time synchronized?

I think yes.
How can i chek?

[cm-ops]

What is the output of this command? sudo salt \* system.get_system_date_time