wazuh not creating alert indexes #6941
Labels
level/task
Task issue
reporter/community
Issue reported by the community
request/operational
Operational requests
type/troubleshooting
Description
wazuh shows two agent as connected, there are indexes like wazuh-statistics and wazuh-monitering that recieve data as expected, however there are no indexes for for wazuh-allerts as shown byt the list of indexes bellow.
Expected Result
Actual Result
green open wazuh-statistics-2024.33w ayYZx1eXSduS7oYgPFoecA 1 0 280 0 252.6kb 252.6kb
green open wazuh-statistics-2024.34w j1xD02R_SBOGAHZAgLSzbg 1 0 74 0 298.4kb 298.4kb
green open .opensearch-observability Dbup7mpUQJq8CPVukXWsYA 1 0 0 0 208b 208b
green open .plugins-ml-config Xd_8Vyl0SEG1Jx_baYPy4Q 1 0 1 0 3.9kb 3.9kb
green open wazuh-monitoring-2024.34w lG8xH9xfRcC0mIYfVQ97vQ 1 0 25 0 144.6kb 144.6kb
green open wazuh-monitoring-2024.33w X10SFiQ1SSWinFVcxLSnkg 1 0 57 0 84.1kb 84.1kb
green open wazuh-states-vulnerabilities-elk.test-demo.com iTdpCSUVQNyxxMYmjprYuQ 1 0 19 0 63.3kb 63.3kb
green open .opendistro_security Ewrj36AuToeNcuLw8oqKdg 1 0 10 0 65.1kb 65.1kb
green open .kibana_1 wtwUwfJUSTyc035PfPaxyg 1 0 12 1 63.4kb 63.4kb
green open .tasks 66BGCKOtRuu3ZMVBxSXd9Q 1 0 2 0 14.2kb 14.2kb
Additional context
i thought at first it must be a filebeat issue but filebeat is connecting properly:
filebeat test output
elasticsearch: https://192.168.210.128:9201...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 192.168.210.128
dial up... OK
TLS...
security... WARN server's certificate chain verification is disabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
the alerts file: /var/ossec/logs/alerts/alerts.json , shows alerts correctly, so it appears that they are arriving to my server:
The text was updated successfully, but these errors were encountered: