No matching indices found: No indices match pattern "wazuh-alerts-*"

[Sunil W]

I am trying to install new Wazuh all in one deployment (https://documentation.wazuh.com/current/deployment-options/elastic-stack/all-in-one-deployment/index.html)and I am facing the below error:

No matching indices found: No indices match pattern "wazuh-alerts-*"

As well as 

Error: The field "timestamp" associated with this object no longer exists in the index pattern. Please use another field. at FieldParamType.e.write.write (https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:361872) at https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:324773 at Array.forEach (<anonymous>) at d (https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:324750) at AggConfig.write (https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:313506) at AggConfig.toDsl (https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:314193) at https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:141274 at Array.forEach (<anonymous>) at agg_configs_AggConfigs.toDsl (https://192.168.25.131/47166/bundles/plugin/data/kibana/data.plugin.js:1:140375) at https://192.168.25.131/47166/bundles/plugin/wazuh/4.4.0-06/wazuh.chunk.3.js:44:1064557

can anyone please help me to fix these error.

[Emiliano Zorn]

Hello Sunil!

Just a precaution, the link you shared for the documentation has expired and no longer corresponds to our guide.
The correct link for an AIO 4.4.0 deployment is as follows:

• Installing Wazuh with Elastic Stack : https://documentation.wazuh.com/current/deployment-options/elastic-stack/index.html#installing-wazuh-with-elastic-stack
• Installing Wazuh  by default (with Opensearch) https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html
• 
  

Having said that, I see that at the time of installation, it was not possible for the product to create the "wazuh-alerts-*" index.

You can try to create it manually, but maybe this error is secondary, because of some inconvenience in the installation or lack of configuration.

To do this you should go to: Stack Management -> Index patterns -> Create index pattern

And once there type the name of the index you want to define.

Please let me know if you are getting any other type of error.

I recommend you to restart the Wazuh Manager, Indexer and Dashboard services.

Regards.

[zaffar abbas]

Hi all,

Can someone please confirm how this issue was resolved? I am facing the same issue. 

Thanks,
Syed

[Alejandro Castro]

Hi all,

I have the same issue, can someone help me to resolve?

Thanks,

Alejandro.