No strelka logs in kibana

[Mastadamus]

I am running security onion 2.3.90 based on the security onion ISO with multiple iterations of soup to get it to 2.3.90 started at 2.3.50 I believe.
I recently realized I am not getting strelka logs ingested into kibana. A check on the indices shows no documents in elastic strelka indice.
Everything is green for so-status. Additionally, when I checked the output of the strelka.log nothing popped up. I've tried restarting strelka to no avail. nothing in logstash logs that mention strelka.

Any suggestions? help would be greatly appreciated.

[dougburks]

Are you sure you are seeing network traffic with files transferred in cleartext?

Do you have anything in /nsm/strelka/processed/?

[Mastadamus]

Yes sir. I have a decent amount of files in that directory and I even downloaded some pdf files from an http source in the clear just to be certain.

[Mastadamus]

I did notice this when I ran salt highstate

          ID: strelkaportavailable
    Function: cmd.run
        Name: netstat -utanp | grep ":57314" | grep -qvE 'docker|TIME_WAIT' && PROCESS=$(netstat -utanp | grep ":57314" | uniq) && echo "Another process ($PROCESS) appears to be using port 57314.  Please terminate this process, or reboot to ensure a clean state so that Strelka can start properly." && exit 1 || exit 0
      Result: True
     Comment: Command "netstat -utanp | grep ":57314" | grep -qvE 'docker|TIME_WAIT' && PROCESS=$(netstat -utanp | grep ":57314" | uniq) && echo "Another process ($PROCESS) appears to be using port 57314.  Please terminate this process, or reboot to ensure a clean state so that Strelka can start properly." && exit 1 || exit 0" run
     Started: 03:38:55.014416
    Duration: 68.872 ms
     Changes:
              ----------
              pid:
                  5652
              retcode:
                  0
              stderr:
              stdout:
 Im not sure if this is applicable. I didn't get any failures in the salt highstate though. 

[Mastadamus]

I fixed this. I re pulled all the docker containers then rebooted and I started getting strelka logs in kibana.