Websocket and Opcua Pipelines missing from default install

[l4zz4r0]

Version

2.4.211

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64GB

Storage for /

300GB

Storage for /nsm

800GB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi there, need help for my installation.

Ive found these lines on /opt/so/log/logstash/logstash.log:

[2026-03-23T08:01:45,681][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["create", {:_id=>nil, :_index=>"logs-zeek-so", :routing=>nil, :pipeline=>"zeek.websocket"}, {"type"=>"redis-input", "elastic_agent"=>{"snapshot"=>false, "version"=>"9.0.8", "id"=>"d33bade0-c80c-4981-a744-a47388345dfa"}, "event"=>{"module"=>"zeek", "category"=>"network", "dataset"=>"zeek"}, "message"=>"{"ts":1774252897.193969,"uid":"CEU4tA1hC7fNO4niEl","id.orig_h":"10.1.2.123","id.orig_p":52090,"id.resp_h":"10.10.0.14","id.resp_p":6067,"host":"10.10.0.14:6067","uri":"/signalr/hubs/connect?transport=webSockets&clientProtocol=1.5&connectionToken=AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA/1s4ld23FU+RjOsIR9wE/QAAAAACAAAAAAAQZgAAAAEAACAAAAAmuGTXVSRbbEgGxOnIxKmDp4DjiogZ0uTVWB1LLagrvgAAAAAOgAAAAAIAACAAAAAPtFwqCOwg1QRSZxtU5RhgBU2d9gNGh3UVeZMDDz4I6jAAAABGAfyuYLFXf1BD/SAHDZu+bfNbaWRg/D7SpRi8sXODUxzqdQpIIzAjLmDMjEWw3/dAAAAAfdEOrDuCoRzvBjOA2/Sm6wSE+yxZFUnJdsTODnrPP3k8vIyaRkNVUT+hobcNYTKpCjvtMrLFKucwvZ84ue75nQ==&connectionData=[{\"name\":\"alarmhub\"},{\"name\":\"controlprocesshub\"},{\"name\":\"machinestatehub\"},{\"name\":\"toastnotificationhub\"}]&tid=6","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36","client_extensions":["permessage-deflate; client_max_window_bits"]}", "data_stream"=>{"type"=>"logs", "namespace"=>"so", "dataset"=>"zeek"}, "agent"=>{"id"=>"d33bade0-c80c-4981-a744-a47388345dfa", "type"=>"filebeat", "ephemeral_id"=>"dcbd6a50-2284-4800-b364-ad4b395f0637", "version"=>"9.0.8", "name"=>"securityonion"}, "tags"=>["elastic-agent", "input-securityonion", "beats_input_codec_plain_applied"], "@timestamp"=>2026-03-23T08:01:45.118Z, "input"=>{"type"=>"filestream"}, "host"=>{"os"=>{"type"=>"linux", "name"=>"Oracle Linux Server", "family"=>"redhat", "kernel"=>"5.15.0-318.199.3.2.el9uek.x86_64", "platform"=>"ol", "version"=>"9.7"}, "containerized"=>false, "name"=>"securityonion", "architecture"=>"x86_64", "ip"=>["192.168.100.203", "fe80::be24:11ff:fe20:76de", "172.17.1.1", "172.17.0.1"], "hostname"=>"securityonion", "mac"=>["16-58-89-29-CB-DA", "26-80-F4-EC-F4-B9", "32-38-C8-F6-3D-24", "36-71-A7-07-8A-D4", "36-7E-BC-27-12-F4", "62-6A-87-A2-15-94", "6A-76-F9-2D-17-0E", "72-D8-10-3B-18-4E", "7E-A9-00-43-73-8A", "96-13-94-8A-99-04", "9A-8D-E2-49-4B-D6", "9E-D0-17-A7-CA-74", "A6-1F-E8-FB-0D-19", "BC-24-11-20-76-DE", "BC-24-11-82-F0-92", "CA-A1-6F-98-B6-36", "DA-03-CC-CA-66-38", "E2-32-85-96-0E-8B", "EA-BA-47-9F-37-D2", "EA-F6-7A-F9-E8-EF", "EE-3E-09-D5-74-95", "F6-F1-ED-D6-F2-73"], "id"=>"cdc71e600b1047e491a49219e96aeb73"}, "@Version"=>"1", "pipeline"=>"websocket", "container"=>{"id"=>"websocket.log"}, "log"=>{"offset"=>6416, "file"=>{"device_id"=>"64514", "inode"=>"6647408", "path"=>"/nsm/zeek/logs/current/websocket.log"}}, "ecs"=>{"version"=>"8.0.0"}, "metadata"=>{"input"=>{"beats"=>{"host"=>{"ip"=>"172.17.1.1"}}}, "input_id"=>"filestream-filestream-81c7883a-8955-49f0-ba36-de9f684c9abe", "type"=>"_doc", "pipeline"=>"zeek.websocket", "beat"=>"filebeat", "stream_id"=>"filestream-filestream.generic-81c7883a-8955-49f0-ba36-de9f684c9abe", "raw_index"=>"logs-zeek-so", "version"=>"9.0.8"}}], :response=>{"create"=>{"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"pipeline with id [zeek.websocket] does not exist"}}}}

Same thing also for zeek.opcua, but In that case I solved disabling zeek opcua module.

Is there a method to install missing pipelines ? There are a lot of performance issues if enable opcua pipeline.

Not found instead a method to disable websocket module.

Thanking in advance

Paolo

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

For the websocket logs see #15657 this is added to the next release.