Sophos module not working

Elastic Security SIEM
1

So I have been waiting for the Sophos XG module for some time since we use Sophos XG FW and when I got to know that 7.9 was released I quickly updated my filebeat and tried setting up the ingest pipeline for sophos but then it threw an error.

[root@WEBWORKS-LOGSTASH filebeat]# filebeat setup --pipelines --modules sophos
Exiting: 1 error: Error loading pipeline for fileset sophos/xg: couldn't load pipeline: couldn't load json. Error: 400 Bad Request: {"error":{"root_cause":[{"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"}],"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"},"status":400}. Response body: {"error":{"root_cause":[{"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"}],"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"},"status":400}
2

Hello @Ameer_Mukadam, please try to remove 'ignore_empty_value' from the 'set' processor, and make sure you use ES 7.9.

3

Sorry my bad, I thought only updating the filebeat will do it. I updated ES today and it worked. Thank you very much.

1 Like
4

No worries, happy to help :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.