setting filebeat wazuh docker

[Владмир Пупкин]

Hi, friends,
Help me with filebeat.
I have wazuh 4.13.1 installed in Docker. How do I change
archives:
         enabled: false
to 

archives:
         enabled: true

me filebeat.yml

bash-5.2# cat ./filebeat.yml
# Wazuh - Filebeat configuration file
filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: false

setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false
output.elasticsearch:
  hosts: ['https://wazuh.indexer:9200']
  username: 'admin'
  password:
  ssl.verification_mode: 'full'
  ssl.certificate_authorities: ['/etc/ssl/root-ca.pem']
  ssl.certificate: '/etc/ssl/filebeat.pem'
  ssl.key: '/etc/ssl/filebeat.key'

logging.metrics.enabled: false

seccomp:
  default_action: allow
  syscalls:
  - action: allow
    names:
    - rseq

[Chukwudalu Chisimdi Okonkwo]

Hello,

To edit that kindly navigate to this path on your Docker Host (if you are using a single node) and then make the changes to the archives in there
/var/lib/docker/volumes/single-node_filebeat_etc/_data/filebeat.yml

Then the changes will reflect on the container once done, no need to re-build the container.

Do let me know if this was helpful.

[Владмир Пупкин]

Thanks, the settings have changed.
bash-5.2# cat /etc/filebeat/filebeat.yml

# Wazuh - Filebeat configuration file
filebeat.modules:
- module: wazuh
alerts:
enabled: true
archives:

enabled: true

Do you need to restart the filebeat service?

четверг, 9 октября 2025 г. в 16:02:53 UTC+3, Chukwudalu Chisimdi Okonkwo:

[Matías Mercado]

Hello,

Yes please restart the filebeat service and then run a test with "filebeat test output"

Regards,
Matías.

[Владмир Пупкин]

Thanks, everything worked !!!

пятница, 10 октября 2025 г. в 00:23:40 UTC+3, Matías Mercado: