Wazuh Docker and s3 plugin error

[Tech Master]

Hi Wazuh lovers,
I'm using Wazuh v4.7.1 Docker single node.
I would like to activate the plugin to be able to snapshot the indexes on an S3 repository but I always receive an error.
To be able to do this I have to enter the Wazuh Indexer container.

https://opensearch.org/docs/latest/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/#amazon-s3

I enter the Wazuh Indexer container
cd /usr/share/wazuh-indexer/bin
I run the command:
./opensearch-plugin install repository-s3

I get the following error:

wazuh-indexer@wazuh:~/bin$ ./opensearch-plugin install repository-s3
./opensearch-env: line 108: cd: /etc/wazuh-indexer: No such file or directory
-> Installing repository-s3
-> Downloading repository-s3 from opensearch
[======================================================================== ] 100%??
-> Failed installing repository-s3
-> Rolling back repository-s3
-> Rolled back repository-s3
Exception in thread "main" java.lang.IllegalStateException: duplicate plugin: - Plugin information:
Name: repository-s3
Description: The S3 repository plugin adds S3 repositories
Version: 2.8.0
OpenSearch Version: 2.8.0
Java Version: 11
Native Controller: false
Extended Plugins: []
  * Classname: org.opensearch.repositories.s3.S3RepositoryPlugin
Folder name:
         at org.opensearch.plugins.PluginsService.readPluginBundle(PluginsService.java:461)
         at org.opensearch.plugins.PluginsService.findBundles(PluginsService.java:440)
         at org.opensearch.plugins.PluginsService.getPluginBundles(PluginsService.java:433)
         at org.opensearch.plugins.InstallPluginCommand.jarHellCheck(InstallPluginCommand.java:853)
         at org.opensearch.plugins.InstallPluginCommand.loadPluginInfo(InstallPluginCommand.java:830)
         at org.opensearch.plugins.InstallPluginCommand.installPlugin(InstallPluginCommand.java:875)
         at org.opensearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:276)
         at org.opensearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:250)
         at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
         at org.opensearch.cli.MultiCommand.execute(MultiCommand.java:104)
         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
         at org.opensearch.cli.Command.main(Command.java:101)
         at org.opensearch.plugins.PluginCli.main(PluginCli.java:60)


The first time I run it I got this error:

wazuh-indexer@wazuh:~/plugins$ /usr/share/wazuh-indexer/bin/opensearch-plugin install repository-s3
/usr/share/wazuh-indexer/bin/opensearch-env: line 108: cd: /etc/wazuh-indexer: No such file or directory
-> Installing repository-s3
-> Downloading repository-s3 from opensearch
[======================================================================== ] 100%??
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
@ WARNING: plugin requires additional permissions @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission getClassLoader
* java.lang.reflect.ReflectPermission suppressAccessChecks
* java.net.NetPermission setDefaultAuthenticator
* java.net.SocketPermission * connect,resolve
* java.util.PropertyPermission opensearch.allow_insecure_settings read,write
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y
-> Failed installing repository-s3
-> Rolling back repository-s3
-> Rolled back repository-s3

[Sebastian Falcone]

Hello, how are you doing?

Try this command so we can have a verbose output of the command:
/usr/share/wazuh-indexer/bin/opensearch-plugin install repository-s3 -b -v

[Tech Master]

Hi Sebastian,

wazuh-indexer@wazuh:~/bin$ ./opensearch-plugin install repository-s3 -b -v

./opensearch-env: line 108: cd: /etc/wazuh-indexer: No such file or directory
-> Installing repository-s3

Checking if url exists: https://artifacts.opensearch.org/releases/plugins/repository-s3/2.8.0/repository-s3-linux-x64-2.8.0.zip

-> Downloading repository-s3 from opensearch

Retrieving zip from https://artifacts.opensearch.org/releases/plugins/repository-s3/2.8.0/repository-s3-2.8.0.zip

[Sebastian Falcone]

Hi,

I didn't saw the following line:

    ./opensearch-env: line 108: cd: /etc/wazuh-indexer: No such file or directory

Have you installed the wazuh-indexer?

Also, is what you send in the previous message is the full output?

[Tech Master]

Hello Sebastian,

It is Wazuh Docker, obviously everything is installed.

Yes, full output.

Can you try by yourself in a clean Wazuh Docker deployment?

Do you think it's an OpenSearch Docker problem?

https://opensearch.org/docs/latest/install-and-configure/plugins/

If you are running OpenSearch in a Docker container, plugins must be installed, removed, and configured by modifying the Docker image. For information, see Working with plugins

https://opensearch.org/docs/latest/install-and-configure/install-opensearch/docker#working-with-plugins

To use the OpenSearch image with a custom plugin, you must first create a Dockerfile. Review the official Docker documentation for information about creating a Dockerfile.

[Sebastian Falcone]

Hello, I will investigate this further with the team. Seems like a new issue

By the way, I was re-checking the logs and saw this:

> Exception in thread "main" java.lang.IllegalStateException: duplicate plugin: - Plugin information:

Could it be that the pluging is already installed?

[Tech Master]

Hello Sebastian,

 Exception in thread "main" java.lang.IllegalStateException: duplicate plugin: - Plugin information:

Because I had already tried to install it.
If you try to deploy Wazuh Docker from scratch, you will see that on the first installation attempt you will have an initial error and, subsequently, you will have the "duplicate" you mentioned.

[Sebastian Falcone]

Okay, the problem is that the path to opensearch differs from the OS to docker. Try the following
export OPENSEARCH_PATH_CONF=/usr/share/wazuh-indexer
/usr/share/wazuh-indexer/bin/opensearch-plugin install repository-s3

[Sebastian Falcone]

Also, were you following some guide? Just to know if we need to update our documentation