Alerts.json and Archive.json are actively written but wazuh indexer did not receive any data

[Bayu Sangkaya (bayusky.labs)]

Dear Wazuh Team,

Right now I'm experiencing problem that I haven't faced before and I need help.
alerts.json and archives.json are actively written by Wazuh analysisd, but data did not sent to wazuh-indexer (index is empty).
And in filebeat log the error is like this:

2026-08-11T14:08:08.930+0700 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc296d06e95715c0b, ext:465791545, loc:(*time.Location)(0x42417a0)}, Meta:{"pipeline":"filebeat-7.10.2-wazuh-archives-pipeline"}, Fields:{"agent":{"ephemeral_id":"632094b7-9380-4592-bcfd-1ba1da0b01ca","hostname":"vm-app-wazuh-manager3-prd-dca","id":"984abad5-3b53-40de-bc80-af1830af4f6f","name":"vm-app-wazuh-manager3-prd-dca","type":"filebeat","version":"7.10.2"},"ecs":{"version":"1.6.0"},"event":{"dataset":"wazuh.archives","module":"wazuh"},"fields":{"index_prefix":"wazuh-archives-4.x-"},"fileset":{"name":"archives"},"host":{"name":"vm-app-wazuh-manager3-prd-dca"},"input":{"type":"log"},"log":{"file":{"path":"/var/ossec/logs/archives/archives.json"},"offset":128758},"message":"{\"timestamp\":\"2026-08-11T14:06:52.554+0700\",\"agent\":{\"id\":\"060\",\"name\":\"vm-db-redis3-stream-hr-dcc\",\"ip\":\"172.18.50.88\"},\"manager\":{\"name\":\"vm-app-wazuh-manager3-prd-dca\"},\"id\":\"1786432012.1093487393\",\"cluster\":{\"name\":\"wazuh_cluster\",\"node\":\"wazuh-3-worker\"},\"full_log\":\"Aug 11 07:06:46 vm-db-redis3-stream-hr-dcc redis-server[45340]: 45340:S 11 Aug 2026 14:06:46.628 * MASTER \u003c-\u003e REPLICA sync started\",\"predecoder\":{\"program_name\":\"redis-server\",\"timestamp\":\"Aug 11 07:06:46\",\"hostname\":\"vm-db-redis3-stream-hr-dcc\"},\"decoder\":{},\"location\":\"journald\"}","service":{"type":"wazuh"}}, Private:file.State{Id:"native::32899106-64513", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000726c30), Source:"/var/ossec/logs/archives/archives.json", Offset:129313, Timestamp:time.Time{wall:0xc296d06e941b7548, ext:443384715, loc:(*time.Location)(0x42417a0)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x1f60022, Device:0xfc01}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [predecoder.timestamp] of type [date] in document with id 'OK6l758BCYhFCN2A91tV'. Preview of field's value: 'Aug 11 07:06:46'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Aug 11 07:06:46] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"date_time_parse_exception: Failed to parse with all enclosed parsers"}}}

Trouble shooting? What I did was: reset filebeat registry, truncate alerts.json and archives.json to 0 so filebeat can follow from last line, but still no solution, now it's 6th hours I am stuck.

Regards,

Bayu Sangkaya

[Stuti Gupta]

Hi Bayu,

The error you're encountering is related to the timestamp format. The Wazuh Indexer is not accepting the timestamp value being sent in the event because it does not match the supported date formats, such as strict_date_optional_time or epoch_millis.

In your case, the problematic value is:

predecoder.timestamp: Aug 11 07:06:46

predecoder.timestamp is mapped as a date field, but this value does not match the expected date format. As a result, the Indexer returns 400 mapper_parsing_exception.  

This is why the events are still generated by the Wazuh manager and written to alerts.json and archives.json, but Filebeat cannot successfully forward them to the Wazuh Indexer.

If you are able to change the timestamp format at the source, use a standard format such as:

2026-08-11T07:06:46.000Z

For JSON logs, Wazuh's template supports formats such as date_optional_time and epoch_millis. You can verify this in:

/etc/filebeat/wazuh-template.json
The mapping will be a keyword 

For reference, the supported built-in date formats are documented here: Elasticsearch built-in date formats

If changing the timestamp at the source is not possible, please send us the log entry from /var/ossec/logs/archives/archives.json that produces this error, along with the configuration being used to collect these logs. I can then reproduce the event and understand better how to handle it.