Wazuh/Opensearch error with the "generate and download" feature

[Uni AT]

Dear Wazuh community, support team,

Our deployment consists of 3 Wazuh Server docker containers (v4.14.6) with an OpenSearch (v2.19.4) integration for logs indexing.

We are facing an error to generate and download reports from the saved searches. Although we are aware that this might be an issue more related to OpenSearch than Wazuh itself, we’d like to know if anyone ever got this problem and how it was fixed.

The error is reproduced below with an account that has administrative rights to exclude a permission issue.

We saved the search security_logs_last_24h which relates to all the entries contained in the index pattern security-auditlog*. The result is those 2 saved objects:

The saved search loads successfully in the dashboard: 

When opening the search and going to Reporting à Generate and download à Generate CSV or Generate XLSX, we get the following error message:

While performing this action, those 2 failed API calls can be seen (multitenancy is NOT enabled):

And this, despite the fact that our saved object does have the same ID cd24f470-9566-11f1-9e17-8f5036b3726d that is reportedly not found, and is referencing well the security-auditlog object with the ID f99a1910-9564-11f1-9e17-8f5036b3726d. 

Please see the attached file with the content of the saved object.

Do you have an idea what the issue might be?

Thank you a lot in advance,

[Olamilekan Abdullateef Ajani]

Hello,

From what you shared, the saved search itself looks valid. The ID shown in the error is the same ID present in the saved object export, so I do not think this is a  "saved object does not exist" issue.

This usually points to a saved-object scope problem. In other words, the Saved Objects UI can see the object, but the Reporting backend is looking for it in a different tenant or .kibana index.

Please confirm whether multitenancy is disabled on all dashboard containers. Check these settings on every dashboard node /etc/wazuh-dashboard/opensearch_dashboards.yml

opensearch_security.multitenancy.enabled: false
opensearch_security.multitenancy.tenants.enable_private: false
opensearch_security.multitenancy.tenants.enable_global: true

Then check where the saved search actually exists:

GET _cat/indices/.kibana*?v
GET .kibana/_doc/search:cd24f470-9566-11f1-9e17-8f5036b3726d

If it is not in .kibana, repeat the GET against any .kibana_* index you find. If the object exists in a tenant-specific index, recreate or re-import the saved search in the Global tenant.

Since you have multiple server containers, also test each container directly. A config difference between containers could also explain why the search opens in the UI but report generation fails.

I await feedback from you