Assistance Needed: Wazuh IndexerConnector Initialization Failed

[trung phạm]

Hello Wazuh Community,

I am experiencing an issue with the Wazuh Inventory module on my deployment. The indexer-connector repeatedly fails to initialize for multiple inventory indexes, as shown in the logs below:

2025/11/07 16:24:20 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-packages-wazuh cluster', retrying until the connection is successful.
2025/11/07 16:24:21 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-inventory-system-wazuh cluster', retrying until the connection is successful. ...

The inventory module seems to start correctly, but the connector cannot reach the indexes. I suspect it might be related to:

• Wazuh Indexer service not running or misconfigured

• Network issues between Wazuh Manager and Indexer

Could you please advise on the steps to resolve this issue? Any guidance on troubleshooting Indexer connectivity or verifying the indexes would be highly appreciated.

Thank you in advance for your help.

Best regards,
Trung

[Stuti Gupta]

The indexer connector error indicates that the indexer connector responsible for the vulnerability and IT hygiene indices is unable to initialize or access the indexer.

To resolve this :

Please check your <indexer> configuration in the ossec.conf file of the manager to ensure it has the same IP and certificate name as you mentioned in the filebeat configuration.
Check the configuration example:
indexer - Local configuration (ossec.conf) · Wazuh documentation:  https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/indexer.html#configuration-exampleYou can find the filebeat

configuration with this command.
cat /etc/filebeat/filebeat.yml

And update the configuration in the ossec.conf file, specifically in the <indexer> section, to match the filebeat configuration. (as shown in the image)

Save the Wazuh indexer username and password in the Wazuh manager keystore.
echo 'admin' | /var/ossec/bin/wazuh-keystore -f indexer -k username
echo 'admin_PASSWORD' | /var/ossec/bin/wazuh-keystore -f indexer -k password

Replace admin_PASSWORD with the password of the admin user.

Now restart the manager.
systemctl restart wazuh-manager

It might take a few minutes to complete the scan.
If this didn't resolve the error, then please share  the output of:
Indexer’s health with Indexer
Indexer management > Dev Tools
 GET _cluster/health

and run the following command at wazuh-manager:
cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"