Merge pull request #12748 from Security-Onion-Solutions/2.4/exclude-e…

…lastalert Exclude Elastalert EQL errors
Security-Onion-Solutions · Apr 4, 2024 · 1017838 · 1017838
2 parents a35bfc4 + 1d221a5
commit 1017838
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check
@@ -198,6 +198,8 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|req.LocalMeta.host.ip"        # known issue in GH
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|sendmail"                     # zeek
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|stats.log"
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Unknown column"               # Elastalert errors from running EQL queries
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|parsing_exception"            # Elastalert EQL parsing issue. Temp.
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|context deadline exceeded"
 fi