Error on wazuh indexer

[Aninda Arista]

The chronology when I wanted to try to login to wazuh dashboard, there were several errors in index pattern and API version with results as below

- Check alerts index pattern
INFO: Index pattern id in cookie: yes [wazuh-alerts-*]
INFO: Getting list of valid index patterns...
ERROR: Request failed with status code 500

- Check API version
INFO: Current API in cookie: [default]
INFO: Getting API version data...
ERROR: Error: An internal server error occurred.

Currently when I want to access the dashboard page it produces the error below

- Wazuh dashboard server is not ready yet

And the status of wazuh-indexer is as follows:

org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
org.opensearch.cli.Command.main(Command.java:101)
org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:138)
org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:104)
May 20 07:20:28 tik systemd-entrypoint[2133178]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-indexer-cluster.log
systemd[1]: wazuh-indexer.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: wazuh-indexer.service: Failed with result 'exit-code'.
systemd[1]: Failed to start wazuh-indexer.service - wazuh-indexer.
systemd[1]: wazuh-indexer.service: Consumed 5,670s CPU time..

How to solve it?

[hasitha.u...@wazuh.com]

Hi Aninda

The "Wazuh dashboard server is not ready yet" error normally indicates that the Wazuh dashboard cannot communicate with the indexer.

I have noticed that the indexer is not up and running. Try restarting the Wazuh indexer and check the status.
systemctl restart wazuh-indexer
systemctl status wazuh-indexer

If the indexer continuously fails, please share the cluster logs to check further.
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Additionally, please confirm that other components are up and running without any issues.
systemctl status wazuh-manager
systemctl status wazuh-dashboard
systemctl status filebeat

Also, share the resource usage.
free -h
df -h
top

Let me know the update on this.

Regards,
Hasitha Upekshitha

[Aninda Arista]

in the previous error occurred because the /etc/wazuh-indexer/backup file experienced a change of owner. After I returned it to its original state with the owner wazuh-indexer:wazuh-indexer, wazuh-indexer could be run and running

After I entered the login page there were several errors as in the image I sent below

One of the errors I got in detail as below

Error: Error Pattern Handler (getPatternList)
at pattern_handler_PatternHandler.getPatternList (https://xxx/410008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:2016485)
at async WzMenu.load (https://xxx/410008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:2253031)
at async WzMenu.componentDidUpdate (https://xxx/410008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:2251777)

[hasitha.u...@wazuh.com]

Hi Aninda 

Let's try restarting all the Wazuh components to check if the issue persists.
You can restart the components with the following commands:
systemctl restart wazuh-manager
systemctl restart wazuh-indexer
systemctl restart wazuh-dashboard
systemctl restart filebeat

Then check the status again, and see if any of the services fail after the restart.

Also, try clearing browser history and cache.

In case all of the above is correct and you are still getting the error, let's check the logs to see what is going on by checking the following:

Wazuh indexer:

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Wazuh dashboard:
journalctl -u wazuh-dashboard | grep -i -E "error|warn"

Also, run this command and share the result.
filebeat test output

Also, have you configured anything at the indexer level and manager level before this issue was raised?

Let me know the update on this.