I removed the Logstash container...

[atomic875]

Version

2.4.170

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

16

RAM

128 GB

Storage for /

155GB

Storage for /nsm

11TB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I removed the Logstash container ( bad advise from an AI) in order to stop data ingestion while reindexing to fix some incompatible fields. I was under the inpresion that the container would regenerate when the machine was called to start-logstash once agian.
I see that it is attempting this , but it fails with a compilation error.
Below is is the output from that...

I would apreciate any help you can offer. I still have several months of logs,etc. in snapshots and I can access the data in Security Onion itself. But no new data entering the system at all.
Thanks again for any assistance or insight you can offer.
DL
[root@ihas-onion david]# so-logstash-start

Starting logstash...

This could take a while if another Salt job is running.
Run this command with --force to stop all Salt jobs before proceeding.

[INFO ] Loading fresh modules for state activity
[ERROR ] Rendering exception occurred
Traceback (most recent call last):
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 468, in render_jinja_tmpl
output = template.render(**decoded_context)
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1304, in render
self.environment.handle_exception()
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 939, in handle_exception
raise rewrite_traceback_stack(source=source)
File "", line 6, in top-level template code
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1408, in make_module
return TemplateModule(self, ctx)
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/environment.py", line 1540, in init
body_stream = list(template.root_render_func(context))
File "/var/cache/salt/minion/files/base/logstash/map.jinja", line 28, in top-level template code
{% for node_type, node_details in logstash_node_data.items() | sort %}
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/sandbox.py", line 392, in call
if not __self.is_safe_callable(__obj):
File "/opt/saltstack/salt/lib/python3.10/site-packages/jinja2/sandbox.py", line 276, in is_safe_callable
getattr(obj, "unsafe_callable", False) or getattr(obj, "alters_data", False)
jinja2.exceptions.UndefinedError: 'None' has no attribute 'items'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 211, in render_tmpl
output = render_str(tmplstr, context, tmplpath)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/templates.py", line 474, in render_jinja_tmpl
raise SaltRenderError(f"Jinja variable {exc}{out}", line, tmplstr)
salt.exceptions.SaltRenderError: Jinja variable 'None' has no attribute 'items'
/var/cache/salt/minion/files/base/logstash/map.jinja(28):

[...]
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}

{% for node_type, node_details in logstash_node_data.items() | sort %} <======================
{% for hostname in logstash_node_data[node_type].keys() %}
{% do LOGSTASH_NODES.append({hostname:node_details[hostname].ip}) %}
{% endfor %}
{% endfor %}

[...]

[CRITICAL] Rendering SLS 'base:logstash' failed: Jinja variable 'None' has no attribute 'items'
/var/cache/salt/minion/files/base/logstash/map.jinja(28):

[...]
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}

{% for node_type, node_details in logstash_node_data.items() | sort %} <======================
{% for hostname in logstash_node_data[node_type].keys() %}
{% do LOGSTASH_NODES.append({hostname:node_details[hostname].ip}) %}
{% endfor %}
{% endfor %}

[...]

local:
Data failed to compile:

Rendering SLS 'base:logstash' failed: Jinja variable 'None' has no attribute 'items'

/var/cache/salt/minion/files/base/logstash/map.jinja(28):

[...]
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}

{% for node_type, node_details in logstash_node_data.items() | sort %} <======================
{% for hostname in logstash_node_data[node_type].keys() %}
{% do LOGSTASH_NODES.append({hostname:node_details[hostname].ip}) %}
{% endfor %}
{% endfor %}

[...]

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

What does this return? sudo salt-call pillar.get logstash:nodes