Security Onion web pages not working

[rserio]

So recently we had our Security Onion off the network because the cable fell out, we fixed that and decided to update to the latest version 2.3.210 and everything seemed to go well enough but when we login to the webpage and click on Alerts, Dashboard, Hunt, Cases we get a 500 error, the kibana dash is a 404. These are teh current errors we have, I tired to do a soup-update once more and I see this.

I can provide teh logs if you watn but there is a lot to go through. I'm hoping you can help us resolve this.

Thanks,

[rserio]

I have changed nothing it is all default. I have attached them both here for review.

motd.Default.txt
motd.CURRENT.txt

[cm-ops]

From what version were upgrading from? Are there any clues in /opt/so/log/kibana/kibana.log or /opt/so/log/soc/sensoroni-server.log? If the original install was before 2.3.60 have you checked to see if Elastic auth is enabled? salt-call pillar.get elasticsearch:auth:enabled

[rserio]

Im on Version: 2.3.210, couldn't tell you the version before. the Elastic auth is on.
local:
True

kibana.log doesn't exist kibana log is 0 bytes and the sesoroni-server.log has a ton of POST but no errors that I can see.

[cm-ops]

Would you be able to provide your soup.log?

[rserio]

As per your request.
soup.log

[cm-ops]

Would you check a couple of things please? First, docker images do you see the images with the tag 2.3.210? Also, salt \* test.ping, do all nodes return true?

[rserio]

Yes I have quite a few of them listed as 2.3.210, attached, when I ran the salt command I get a break at linux_idh. Minion

sudo salt * test.ping
tmplinux_idh:
True
templinux_idh:
True
secuityonion_standalone:
True
linux_idh:
Minion did not return. [No response]
The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:

salt-run jobs.lookup_jid 20230215140236157648

DockerVersions210.txt

[cm-ops]

Is that node still active? Would you also take a look in the Elasticsearch log and Logstash log and see if there are any clues in there there?