Errors in Logstash.log

[stevewillia]

Security Onion 2.3.21

They just started occurring. Seems like the Suricata parser is not matching the type [suricata.]

[2021-01-27T14:27:39,565][INFO ][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
[2021-01-27T14:28:43,572][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 500 ({"type"=>"illegal_state_exception", "reason"=>"Pipeline processor configured for non-existent pipeline [suricata.]"})

Any ideas why or how to fix?

Steve

[weslambert]

What kind of install are you running? Standalone/Distributed? Are you using any custom parsing or log sources? Are you using Suricata for network metadata, or just alerts? I would expect that the dataset portion, the name that comes after the . would be defined, but that does not seem to be the case.

[stevewillia]

After a reboot it cleared up. Don't ask me why....

Thanks

[TotieBash]

@weslambert can you pls look at thread also, it looks like you have seen this issue before. I'm also getting "non-existent pipeline [suricata.]" on the SO 2.4.50. I am using Suricata as metadata engine.
#12459