Upgrade Question

[sdresen]

When I installed pfElk I didn't have Snort enabled at the time and thus didn't load the Snort json file. I've since started using Snort again and went to load the current Snort json file but am getting the following error:

Sorry, there was an error

The file could not be processed due to error: "Unprocessable Entity: Document "02445e60-116b-11eb-8725-ed0ed9b0ff36" has property "visualization" which belongs to a more recent version of Kibana [7.11.0]. The last known version is [7.10.0]"

Was hunting for instructions in your docs about how to upgrade but haven't found them yet. Can you point me to them or let me know if there is a way to upgrade?

Thanks

[a3ilson]

@sdresen - Sorry for the delay... I do not always get notifications from the discussions.

So to clarify, the issue you are having is that when attempting to import the snort.ndjson file, you are prompted with an error identified above? Seems odd...I do not run snort but was able to import within my current instance (7.11.0).

[sdresen]

Thanks for the pointers. I am running it in a VM and took a snapshot so I could try a few things and revert back as needed. In doing that I realized I was running with docker containers, not the scripted install. I ended up exporting my visualizations from the instance I was running and just rerunning your script so I was using pfElk natively on the OS versus containers given I have a dedicated VM for it. That way, future updates will be automatic as I run OS/package updates. As I'm still learning, I wasn't able to figure out how to update the docker version of pfElk with existing data. I was able to download updated ELK images, changed the tags of the images, but every time I ran docker compose, the containers rebuilt with the same version I had been running on instead of the updated images I had downloaded.

[a3ilson]

You'll need to edit the docker-compose.yml file and amend the version and/or variable.

[sdresen]

I was on that path having determined in docker-compose.yml that the following was driving the version it was using for ELK

args:
ELK_VERSION: $ELK_VERSION_

In the Dockerfile for each component, the

ARG ELK_VERSION
FROM docker.elastic.co/elasticsearch/elasticsearch:${ELK_VERSION}

looks to be pulling version from the image source. I got stuck at this point trying to figure out what to modify to get it to use the updated image I had pulled down.

[a3ilson]

there should be a .env file (nano .env) and amend the version. Then restart the docker containers.

[sdresen]

So close, thanks.