CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-08-30 11:19:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

exclude elasticsearch indexing error during upgrade for temporarily outdated policies

Browse Source
This commit is contained in:
reyesj2
2026-08-27 21:17:27 -05:00
parent 4786d359fb
commit f8401bef37
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/common/tools/sbin/so-log-check
+2 -1
View File
@@ -241,6 +241,7 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|tcp 127.0.0.1:6791: bind: address already in use" # so-elastic-fleet agent restarting. Seen starting w/ 8.18.8 https://github.com/elastic/kibana/issues/201459
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|TransformTask\] \[logs-.*user so_kibana lacks the required permissions" # Known issue with integrations starting transform jobs that are explicitly not allowed to start as a system user
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|manifest unknown" # appears in so-dockerregistry log for so-tcpreplay following docker upgrade to 29.2.1-1
EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Could not index event to Elasticsearch.*\"version\" => \"9.0.8\"" # Expected during Elastic upgrade temporarily, as policies referencing older pipelines are updated
fi
RESULT=0
@@ -305,4 +306,4 @@ else
echo -e "\nResult: One or more errors found"
fi
exit $RESULT
exit $RESULT