ElasticSearch Fault after soup (was stuck in pending in prior release) 2.4.120

[mazda4409]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

24

Storage for /

69

Storage for /nsm

133

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Chief complaint: Elasticsearch status: "Fault"

HW Specs:

System Model HP Z4 G4 Workstation

OS Name Microsoft Windows 11 Pro (fresh install)

Version 10.0.26100 Build 26100

BIOS Version/Date HP P62 v02.92, 8/10/2023

System SKU6AD81UC#ABA

BIOS Mode UEFI

Intel(R) Core(TM) i9-7900X CPU @ 3.30GHz, 3301 Mhz, 10 Core(s), 20 Logical Processor(s)

Installed Physical Memory (RAM)128 GB

SSD FX900 4TB HP m.2 NVME PCIe Gen4

GPU - Nvidia Quadro P4000 8GB DDR5

NICs: 2.5 GBPS uplink and x2 2.5 GBPS TAP NICs from ETAP-XG on a 2.5 GBPS network 

CLEAN Win11 install, fresh SO install on v. prior to latest where ElasticSearch was stuck in pending

ElasticSearch is the problem here and is erroring out.

Restarted SO and Elasticsearch, no dice. What's the deal now? Was told to upgrade to fix the "pending" state and now it's completely failed. Now I regret upgrading.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[mazda4409]

Two indexes cannot be corrected with the command:
sudo so-elasticsearch-query $index/_settings -d '{"number_of_replicas":0}' -XPUT
They are stuck in unassigned: (sudo so-elasticsearch-query _cat/shards | grep UN)

sudo docker logs so-elasticsearch

Do I need to do a fresh install after every release?

[mazda4409]

sudo cat /opt/so/log/elasticsearch/securityonion.log|less




"Search rejected due to missing shards" and it attaches the shards that are unassigned

[mazda4409]

[mazda4409]