WAZUH - No API Available to Connect

[zaffar abbas]

Hi Team,

Can someone please guide me for the following error I am facing (image attached wazuherror)?

I have attached wazuh.yml snapshot as well as reference for the API error.

Just for information, port set for Kibana is 443 as well.

[Tomas Benitez Vescio]

Hi,

Thanks for using Wazuh!

Could you share more information about your situation like what version of Wazuh are using, how did you install it and what are the steps you have taken so far? 

From what you have shared and mentioned so far it could be possible that the configuration in wazuh.yml is not correct, you have set the port of the REST API of the Wazuh Manager to be 443 but by default this port is 55000. If you have change this setting then you would also need to change the port used for Kibana otherwise one of this two process would not be able to run because the port it wants to use is already taken. You may find the documentation for Wazuh Dashboard configuration file useful.

Regards.

[zaffar abbas]

Thank you for your response Thomas. Actually the installation process was a bit difficult for me as I had to install elasticsearch and kibana via manual .deb file and downloaded filebeat directly from packages.wazuh site. I am using an all-in-one deployment structure.

I am using wazuh-manager version 4.5.1 having kibana plugin 7.17.9. 

Could you please confirm if it is necessary to have kibana port and port in wazuh.yml file different. Can I not use port 443 on both systems?

Regards,
Syed 

[Tomas Benitez Vescio]

The port indicated in the wazuh.yml configuration should be the port that is used by the Wazuh Server REST API (Wazuh architecture for reference) and not the port that is used by Kibana. And just to be clear, what i mean in my original comment is that if you are running all the Wazuh components in the same system you should not be able to run Kibana and the required Wazuh Server REST API using the same port.

[zaffar abbas]

Thank you Thomas I will check if port 55000 is enabled at my end or not. 

Moreover could you please confirm how can I solve issue pertaining with the index pattern alert?

[Tomas Benitez Vescio]

The error "No template found for the selected index pattern" is usually caused by a misconfiguration of Elasticsearch. I recommend you check the following documentations to try and fix the error: Installing Wazuh with Elastic Stack and No template found for the selected index pattern.

[zaffar abbas]

Hi Tomas.

I have managed the API connection issue but the Index Pattern issue is still there and I guess because of this I am unable to visualize events from enrolled systems on dashboard. I am using Kibana 7.17.9 with WAZUH 4.5.1. Kindly help me with this as this is getting a big issue for me.

I have attached snapshot of the error I am facing as well. The no matching indices alert gets generated on the health check page and timestamp one is generated when WAZUH dashboard is connected.

Kindly help me with this at your earliest!
I will be eternally grateful to you for your cooperation
Awaited for your response.

[zaffar abbas]

Just for the reference the issue has been sorted out! The protocol in filebeat.yml file was set to https. When I set it to http the issue got resolved