problems in rollover index

Fabio Miotti

unread,

Mar 8, 2021, 4:09:10 AM3/8/21

to Wazuh mailing list

Hi

wazuh-management is 4.0.3

the disk server is busing almost so i have tryed to search the problem and i have seen these error when i launch the command:

cat /var/log/elasticsearch/elasticsearch.log | grep -i -E "error|warn"

"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step

[2021-03-08T09:52:52,983][ERROR][o.e.x.i.IndexLifecycleRunner] [elasticsearch] policy [wazuh-retention-policy] for index [wazuh-alerts-4.x-2021.02.27] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step

[2021-03-08T10:02:52,980][INFO ][o.e.x.i.IndexLifecycleRunner] [elasticsearch] policy [wazuh-retention-policy] for index [wazuh-alerts-4.x-2021.03.03] on an error step due to a transitive error, moving back to the failed step [check-rollover-ready] for execution. retry attempt [386]

[2021-03-08T10:02:52,980][INFO ][o.e.x.i.IndexLifecycleRunner] [elasticsearch] policy [wazuh-retention-policy] for index [wazuh-alerts-4.x-2021.02.28] on an error step due to a transitive error, moving back to the failed step [check-rollover-ready] for execution. retry attempt [602]

[2021-03-08T10:02:52,981][INFO ][o.e.x.i.IndexLifecycleRunner] [elasticsearch] policy [wazuh-retention-policy] for index [wazuh-alerts-4.x-2021.03.01] on an error step due to a transitive error, moving back to the failed step [check-rollover-ready] for execution. retry attempt [530]

[

Fabio Miotti

unread,

Mar 9, 2021, 9:55:59 AM3/9/21

to Wazuh mailing list

nobody has this problem in rollover of indexes? both wazuh-management 4.0.1 and 4.1.0 have same problem

nothing rollover has happened also i have followed this link https://wazuh.com/blog/wazuh-index-management/

Fabio Miotti

unread,

Mar 9, 2021, 10:12:35 AM3/9/21

to Wazuh mailing list

same poblemalso for 4.1.1

in wazuh-alerts-4.x-2021.03.06,add "lifecycle policy" and i have this same error that i have in 4.0.3 and 4.1.0

" illegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [wazuh-alerts-4.x-2021.03.06] is empty or not defined"

Franco Charriol

unread,

Mar 12, 2021, 9:06:21 AM3/12/21

to Wazuh mailing list

Hi Fabio,

What version of Elasticsearch are you using? Are you using Opendistro too? What version?
Thanks

Fabio Miotti

unread,

Mar 12, 2021, 9:34:40 AM3/12/21

to Wazuh mailing list

Hi Franco

thank for your help if you can.

i don't use open distro but i have installed all using "unattended installation" from ""all-in-one-deployment" (https://documentation.wazuh.com/current/installation-guide/more-installation-alternatives/elastic-stack/all-in-one-deployment/unattended-installation.html)

the version of elasticsearch is 7.9.3

Franco Charriol

unread,

Mar 12, 2021, 5:22:22 PM3/12/21

to Wazuh mailing list

sorry for the delay I've had a lot of work
please let me reproduce it locally and I'll give you some feedback maybe next week, could it be?
Kind regards

Fabio Miotti

unread,

Mar 15, 2021, 4:37:30 AM3/15/21

to Wazuh mailing list

Hi Franco surely

i wait your feedback if you can.

Thanks

Franco Charriol

unread,

Mar 16, 2021, 10:01:40 AM3/16/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio,
I'm trying to reproduce the problem.
I figured out in your logs the 'hot phase' is enabled apparently, but the guide that you mention (https://wazuh.com/blog/wazuh-index-management/) recommends disable it.

"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
[2021-03-08T09:52:52,983][ERROR][o.e.x.i.IndexLifecycleRunner] [elasticsearch] policy [wazuh-retention-policy] for index [wazuh-alerts-4.x-2021.02.27] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step

It's enabled, right? Just to configure my env like yours.

Thanks

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/GbOprtSvIfQ/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/512abf14-5d66-40bc-a220-e7fa7f2f479fn%40googlegroups.com.

Fabio Miotti

unread,

Mar 16, 2021, 10:29:18 AM3/16/21

to Wazuh mailing list

Hi Franco

what method can you suggest to delete indexes older thant 4months?

i have created index lifetime policy

hot phase:30days

cold phase: 60days

delete phase: 120days

than applied it to a template

it seems to work but in my case,if i launch the command cat /var/log/elasticsearch/elasticsearch.log | grep -i -E "error"

i see a lot of errors

Thanks

Franco Charriol

unread,

Mar 16, 2021, 10:45:15 AM3/16/21

to Fabio Miotti, Wazuh mailing list

I think that values are ok.
could you share your policy request, please? In order to check if any variable is possibly causing the WARN logs.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/b79ea03f-b170-4dc5-9795-43d4b929281en%40googlegroups.com.

Fabio Miotti

unread,

Mar 16, 2021, 10:58:34 AM3/16/21

to Wazuh mailing list

PUT _ilm/policy/wazuh-retention-policy { "policy": { "phases": { "hot": { "min_age": "0ms", "actions": { "rollover": { "max_age": "30d", "max_size": "50gb" }, "set_priority": { "priority": 100 } } }, "cold": { "min_age": "60d", "actions": { "set_priority": { "priority": 0 } } }, "delete": { "min_age": "120d", "actions": { "delete": { "delete_searchable_snapshot": true } } } } } }

Franco Charriol

unread,

Mar 16, 2021, 2:12:48 PM3/16/21

to Fabio Miotti, Wazuh mailing list

Unfortunately, I wasn't able to reproduce it, the indexes all rollover properly without any WARN or ERROR logs in Elasticsearch.

Maybe you could check more info with this query in Kibana Dev tools
if the policy was correctly applied in the template

GET wazuh-alerts-*/_iml/exaplain

or directly with some particular index

GET wazuh-alerts-4.x-2021.02.24/_iml/explain

You can find more info here

I couldn't find any problem in Elastic forums or Google about this problem either. Only when the template or the policy has aliases, that if I'm right is not your case.

Personally, I think if the rollover is doing well, the logs are may be caused by some resource problem (not enough disk space, low RAM, or high processing levels), but I'm afraid I can't reproduce these requirements at this very moment.

Please provide the result of the above query just in case

Regards

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/1628f4ab-fd80-4de1-8fbb-d8a829f0fb65n%40googlegroups.com.

Fabio Miotti

unread,

Mar 18, 2021, 6:54:54 AM3/18/21

to Wazuh mailing list

Hi Franco

i have same problem in a new installation in new server with wazuh-management 4.1 so the problem is not only in one server but probably all installation from unattended:

https://documentation.wazuh.com/current/installation-guide/more-installation-alternatives/elastic-stack/all-in-one-deployment/unattended-installation.html

so i have 2 server with same problem.

if i launch: GET wazuh-alerts-4.x-*/_ilm/explain, i have this result: what do you think?

{
"indices" : {
    "wazuh-alerts-4.x-2021.02.15" : {
      "index" : "wazuh-alerts-4.x-2021.02.15",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.01.03" : {
      "index" : "wazuh-alerts-4.x-2021.01.03",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.02.16" : {
      "index" : "wazuh-alerts-4.x-2021.02.16",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.01.04" : {
      "index" : "wazuh-alerts-4.x-2021.01.04",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.02.13" : {
      "index" : "wazuh-alerts-4.x-2021.02.13",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.01.01" : {
      "index" : "wazuh-alerts-4.x-2021.01.01",
      "managed" : false
    },
    "wazuh-alerts-4.x-2021.02.14" : {
      "index" : "wazuh-alerts-4.x-2021.02.14",
      "managed" : false
    },

Fabio Miotti

unread,

Mar 18, 2021, 7:25:34 AM3/18/21

to Wazuh mailing list

Hi Franco

in the result there is also these errors that i have seen just now:

"wazuh-alerts-4.x-2021.03.03" : {
      "index" : "wazuh-alerts-4.x-2021.03.03",
      "managed" : true,
      "policy" : "wazuh-retention-policy",
      "lifecycle_date_millis" : 1614729605670,
      "age" : "15.45d",
      "phase" : "hot",
      "phase_time_millis" : 1616064034476,
      "action" : "rollover",
      "action_time_millis" : 1614729740847,
      "step" : "ERROR",
      "step_time_millis" : 1616064634474,
      "failed_step" : "check-rollover-ready",
      "is_auto_retryable_error" : true,
      "failed_step_retry_count" : 1110,
      "step_info" : {
        "type" : "illegal_argument_exception",
        "reason" : "setting [index.lifecycle.rollover_alias] for index [wazuh-alerts-4.x-2021.03.03] is empty or not defined",
        "stack_trace" : """java.lang.IllegalArgumentException: setting [index.lifecycle.rollover_alias] for index [wazuh-alerts-4.x-2021.03.03] is empty or not defined
   at org.elasticsearch.xpack.core.ilm.WaitForRolloverReadyStep.evaluateCondition(WaitForRolloverReadyStep.java:65)
   at org.elasticsearch.xpack.ilm.IndexLifecycleRunner.runPeriodicStep(IndexLifecycleRunner.java:174)
   at org.elasticsearch.xpack.ilm.IndexLifecycleService.triggerPolicies(IndexLifecycleService.java:329)
   at org.elasticsearch.xpack.ilm.IndexLifecycleService.triggered(IndexLifecycleService.java:267)
   at org.elasticsearch.xpack.core.scheduler.SchedulerEngine.notifyListeners(SchedulerEngine.java:183)
   at org.elasticsearch.xpack.core.scheduler.SchedulerEngine$ActiveSchedule.run(SchedulerEngine.java:211)
   at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
   at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
   at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
   at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
   at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
   at java.base/java.lang.Thread.run(Thread.java:832)
"""
      },

Franco Charriol

unread,

Mar 18, 2021, 3:24:55 PM3/18/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio,
that's what we were looking for.

I think the property "index.lifecycle.rollover_alias" is missing from your template thus in your created indexes too.
You could check it running this query in Kibana Dev tools

GET _template/wazuh

I got this after applied the policy to the template from UI

It was enough for me and the rollover works properly, but Elastic says here that the above property is required for rollover,
So, you could try creating some new template as the Elastic doc or you could add it to the current template from the UI but it could be replaced in futures releases.

Then you should do this step to bootstrap the alias with this query

PUT wazuh-alerts-000001
{
"aliases": {
"wazuh": {
"is_write_index": true
}
}
}

You could check it again with

GET wazuh-alerts-*/_iml/explain

Please let me know any updates.

Best

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/d0bb68a6-6642-4f8d-b913-5d42de33ea1cn%40googlegroups.com.

Fabio Miotti

unread,

Mar 19, 2021, 9:32:41 AM3/19/21

to Wazuh mailing list

Hi Franco

so you were right for 1 step: "index.lifecycle.rollover_alias" missing for template wazuh.

so i have edited the template wazuh adding this voice:

"lifecycle": {

"name": "wazuh-retention-policy",

"rollover_alias": "wazuh"

},

now with command "GET _template/wazuh" i have same to you:

{

"wazuh" : {

"order" : 0,

"version" : 1,

"index_patterns" : [

"wazuh-alerts-4.x-*",

"wazuh-archives-4.x-*"

],

"settings" : {

"index" : {

"lifecycle" : {

"name" : "wazuh-retention-policy",

"rollover_alias" : "wazuh"

},

"mapping" : {

"total_fields" : {

"limit" : "10000"

}

},

------------------------------------------------------------------------------------------

then i have launched this command:

PUT wazuh-alerts-000001

{
"aliases": {
"wazuh": {
"is_write_index": true
}
}
}

------------------------------------------------------------------------------------------

After i launched this: GET wazuh-alerts-*/_iml/explain --> i have this error:

{

"error" : {

"root_cause" : [

{

"type" : "security_exception",

"reason" : "action [indices:data/read/get] is unauthorized for user [elastic]"

}

],

"type" : "security_exception",

"reason" : "action [indices:data/read/get] is unauthorized for user [elastic]",

"caused_by" : {

"type" : "illegal_state_exception",

"reason" : "There are no external requests known to support wildcards that don't support replacing their indices"

}

},

"status" : 403

}

Franco Charriol

unread,

Mar 19, 2021, 4:53:31 PM3/19/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio

I found this related issue in the Elasticsearch repo, maybe your user 'elastic' need the manage index privilege for wazuh indexes.

Could you check it, please?

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/61532bdc-6c7e-4c43-9be6-c6b4dc74c20bn%40googlegroups.com.

Fabio Miotti

unread,

Mar 22, 2021, 10:57:00 AM3/22/21

to Wazuh mailing list

Hi Franco

for me it's not clear what i need to do.

however,the problem is present in all new installation of server with the link https://documentation.wazuh.com/4.0/installation-guide/more-installation-alternatives/elastic-stack/all-in-one-deployment/unattended-installation.html

so i'm surprise that you cannot recreate the problem.

Franco Charriol

unread,

Mar 22, 2021, 4:21:15 PM3/22/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio,

I'll try to reproduce it again from scratch.
is your new installation running with new Wazuh indices too? In that case, can you share the policy request again with the new values, the previous was with 30 days so it'll not work with me.

Remaining the previous response. I f you are using the default user for Elasticsearch from this link, forget it. But if you are setting a new Elasticsearch user from here for example:

Please make sure the custom user has the minimum permission required for the Wazuh index

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/81ad1906-a102-4d5f-a237-a6b9414bbdcbn%40googlegroups.com.

Fabio Miotti

unread,

Mar 23, 2021, 3:39:29 AM3/23/21

to Wazuh mailing list

Hi Franco

i'm using ubuntu server 20.04

i have done 2 new servers with new indexes and both server have same problems. the first server installed in december 2020,the second server installed 2 weeks ago. For second server i have created same retiontion policy of first and it has had immediately same problem so you should see the problem just installed.

i have not created new user and i'm using default user.

Franco Charriol

unread,

Mar 25, 2021, 10:55:43 AM3/25/21

to Fabio Miotti, Wazuh mailing list

Fabio

can you share the repose of this query in Kibana / Dev tools, please? But of your new server

GET _cat/indices

Thanks

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/467a8a74-059a-48a8-a390-50a1425679fan%40googlegroups.com.

Fabio Miotti

unread,

Mar 29, 2021, 10:18:11 AM3/29/21

to Wazuh mailing list

Hi Franco

with GET _cat/indices i have this result:

1824 0 563.3kb 563.3kb

green open wazuh-monitoring-2021.01.31 RYDU3BRjR9mlFMMd9hTsyA 2 0 1824 0 570.6kb 570.6kb

green open wazuh-monitoring-2021.02.01 SS8W4djpQhmSQL1bDBKLFA 2 0 1824 0 565.8kb 565.8kb

green open wazuh-monitoring-2021.02.06 vYocHImrTf2_NRlQIcb-Rg 2 0 1824 0 562.4kb 562.4kb

green open wazuh-monitoring-2021.02.07 1JU-51V4SYC5koUnqfmlFA 2 0 1805 0 520.5kb 520.5kb

green open wazuh-monitoring-2021.02.08 f0gGaRzGT4Wjhuc6SGjuRQ 2 0 1824 0 557.5kb 557.5kb

green open wazuh-monitoring-2021.02.09 A5YyT0nmTWm_zscm2S2tsg 2 0 1824 0 563.9kb 563.9kb

green open wazuh-monitoring-2021.02.02 PGJ3HmZQSf6lZ0BztKJRLQ 2 0 1824 0 559.4kb 559.4kb

green open wazuh-monitoring-2021.02.03 vNQhAzyXQJe1otJU52K6tg 2 0 1824 0 562.3kb 562.3kb

green open wazuh-monitoring-2021.02.04 upNvcfn1QduZ_SNcrW7Umw 2 0 1824 0 562.9kb 562.9kb

green open wazuh-monitoring-2021.02.05 YocaJXKsRCKNVTbTfqDgvw 2 0 1824 0 559.4kb 559.4kb

green open wazuh-alerts-4.x-2021.02.15 VUAzAsj6RL2IxDodsvztTA 3 0 167299 0 300.5mb 300.5mb

green open wazuh-alerts-4.x-2021.02.16 upQs6KM8SIqjpdd_upcMsA 3 0 164952 0 296.8mb 296.8mb

green open wazuh-alerts-4.x-2021.02.13 VoQ0ay6SR9ibFulDB0NcqQ 3 0 134916 0 240.8mb 240.8mb

green open wazuh-alerts-4.x-2021.02.14 XdqDYhNIT1ONcO3rnsH1Xw 3 0 127926 0 228.9mb 228.9mb

green open wazuh-alerts-4.x-2021.02.19 8_h-Gwa0SpWwvBydUwSuhQ 3 0 164111 0 295.2mb 295.2mb

green open wazuh-alerts-4.x-2021.02.17 0xxTkXbRRJyELYcJ28I2Dg 3 0 166041 0 297.7mb 297.7mb

green open wazuh-alerts-4.x-2021.02.18 pEuZuC-OSL6uY7bAy25UIQ 3 0 176854 0 318.1mb 318.1mb

green open wazuh-alerts-4.x-2021.02.11 X2mzpoM4RJa6Wqdqw7HQig 3 0 177013 0 319.4mb 319.4mb

green open wazuh-alerts-4.x-2021.02.12 2z95enskQpWrg7YVnplYrA 3 0 172140 0 309.8mb 309.8mb

green open wazuh-alerts-4.x-2021.02.10 WqKQ7Q3rQdC4-WcvNd2kDg 3 0 179492 0 324.3mb 324.3mb

green open wazuh-monitoring-2021.02.10 71Ez26tLTEWe9ieD3a7l7g 2 0 1824 0 558.9kb 558.9kb

green open wazuh-monitoring-2021.02.11 e_drJQlQTiGOkzpYeWNtig 2 0 1824 0 559.9kb 559.9kb

green open wazuh-monitoring-2021.02.12 cyn5i2hTR7G-QnVHIbfCdg 2 0 1824 0 552.1kb 552.1kb

green open wazuh-monitoring-2021.02.17 fNJU8qbwRKyB19pBHIAFdg 2 0 1824 0 558.3kb 558.3kb

green open wazuh-monitoring-2021.02.18 DTG6Wtd4S2So5gz1bPQ2sQ 2 0 1824 0 555.3kb 555.3kb

green open wazuh-monitoring-2021.02.19 _lzFcJGZQDGnoLlQ5klz7g 2 0 1824 0 550.2kb 550.2kb

green open wazuh-monitoring-2021.02.13 m5YY_9VAS1K0JdyRlLkSSQ 2 0 1824 0 555.7kb 555.7kb

green open wazuh-monitoring-2021.02.14 osMC9j7SRXO3NYRVnY8diw 2 0 1824 0 555.7kb 555.7kb

green open wazuh-monitoring-2021.02.15 9qpA9HQxQqiuS5c2GUguiA 2 0 1824 0 548.2kb 548.2kb

green open wazuh-monitoring-2021.02.16 aFYmlz8mTZ6mlbFPJu6r8A 2 0 1824 0 551.2kb 551.2kb

green open wazuh-alerts-4.x-2021.02.04 CVQ4Mi58Tv6bQu6URd4q-A 3 0 173620 0 312.8mb 312.8mb

green open wazuh-alerts-4.x-2021.02.05 Yb2VC1KSTCK37fd1R8gZ9A 3 0 170166 0 307.3mb 307.3mb

green open wazuh-alerts-4.x-2021.02.02 xKBAqmj3TZqjVLXKA-dl9w 3 0 205389 0 367.7mb 367.7mb

green open wazuh-alerts-4.x-2021.02.03 QRcZ-huNTCCOjifgD4leiA 3 0 205086 0 365.5mb 365.5mb

green open wazuh-alerts-4.x-2021.02.08 ciOWWYkRSXC7h6Wz-9Eh2Q 3 0 206808 0 369.1mb 369.1mb

green open wazuh-alerts-4.x-2021.02.09 HIelr5NiQWy5Glx4i33cOg 3 0 185220 0 333.7mb 333.7mb

green open wazuh-alerts-4.x-2021.02.06 0UNhC0fTTmKiNekdcoV8qQ 3 0 131962 0 236.6mb 236.6mb

green open wazuh-alerts-4.x-2021.02.07 jn-kBMmMQF-2nymJWI9RnA 3 0 126286 0 226mb 226mb

green open wazuh-alerts-4.x-2021.02.01 XbCvPXb1TvChZT0cKqtD1A 3 0 184387 0 330.9mb 330.9mb

green open wazuh-alerts-4.x-2021.01.30 0kFqcQe7SCSr1ssdZsNHFQ 3 0 130307 0 233.8mb 233.8mb

green open wazuh-alerts-4.x-2021.01.31 tRTfYw6aRGCzlszvZMBI7g 3 0 123636 0 220.7mb 220.7mb

green open wazuh-monitoring-2021.02.20 QHK5bUtHREK7dR8-rXABww 2 0 1824 0 554.3kb 554.3kb

green open wazuh-monitoring-2021.02.21 2RyI5LEIQWSnAjcAKpGZMw 2 0 1843 0 592kb 592kb

green open wazuh-monitoring-2021.02.22 bGPQUDoZRKyEJUKGKfw32A 2 0 1824 0 561.8kb 561.8kb

green open wazuh-monitoring-2021.02.23 LMj_KDcrTh2tJhYEfQgx9g 2 0 1824 0 557.3kb 557.3kb

green open wazuh-statistics-2021.53w ej-fOOoaQqak5F96oxoQpg 2 0 1704 0 617.4kb 617.4kb

green open wazuh-monitoring-2021.02.28 5d6rgu9eQkWKTj6rFeciFA 2 0 1824 0 560.1kb 560.1kb

green open wazuh-statistics-2021.1w EwoB2tyyRuSQ39IQCCXK0w 2 0 2 0 25.7kb 25.7kb

green open wazuh-monitoring-2021.02.24 jkZB3INHRtaAyHxEqXg31w 2 0 1824 0 558.5kb 558.5kb

green open wazuh-monitoring-2021.02.25 u3jJ4WCgThKtCgGJLdehyg 2 0 1824 0 554.9kb 554.9kb

green open wazuh-monitoring-2021.02.26 mdjRKjo2SiqM4ZMLoA_ibg 2 0 1824 0 557.1kb 557.1kb

green open wazuh-monitoring-2021.02.27 mLj420zNQnqYAXilRNJ05g 2 0 1824 0 558.3kb 558.3kb

green open wazuh-alerts-4.x-2021.01.25 gE68k1cbRpGV_NQrZcMpug 3 0 178634 0 321.5mb 321.5mb

green open wazuh-alerts-4.x-2021.01.26 iOq8c02lSqiQc9vjWpvVWw 3 0 168536 0 304.6mb 304.6mb

green open wazuh-alerts-4.x-2021.01.23 cw0VQGcLSAW8Uh9kY_VEPg 3 0 134904 0 242mb 242mb

green open wazuh-alerts-4.x-2021.01.24 Gj3GynhNT46d14F-sX1ISQ 3 0 125934 0 225.1mb 225.1mb

green open wazuh-alerts-4.x-2021.01.29 8FBRBsTLTn-lWPcKhus1Pg 3 0 165604 0 299.1mb 299.1mb

green open wazuh-alerts-4.x-2021.01.27 8_5IMyMmS3y2_SCPyX6GFA 3 0 176709 0 320.1mb 320.1mb

green open wazuh-alerts-4.x-2021.01.28 bazE3uQmSWWce4DYz7LIqw 3 0 166127 0 299.3mb 299.3mb

green open wazuh-alerts-4.x-2021.01.21 aMrQNeBaS_GIFJWc8XVXWA 3 0 172903 0 312.4mb 312.4mb

green open wazuh-alerts-4.x-2021.01.22 D9NcoXjkRkSLLQXtTQPO7g 3 0 184473 0 331.6mb 331.6mb

green open wazuh-alerts-4.x-2021.01.20 nSe1b3F1Tce7mNPX6gUa2A 3 0 180097 0 323.5mb 323.5mb

green open wazuh-monitoring-2021.03.02 JhZyzkHfQueQx2gnZwMfyA 2 0 1824 0 557.6kb 557.6kb

green open wazuh-monitoring-2021.03.01 IQDHVrIcTumCwzyg_56PFA 2 0 1824 0 557.6kb 557.6kb

green open wazuh-monitoring-2021.03.08 Hh6NOihPRQuXY0p6fu8b1A 2 0 1728 0 527kb 527kb

green open wazuh-monitoring-2021.03.07 gA8pWoAfQRKdiyD-bSN5lg 2 0 1728 0 527.4kb 527.4kb

green open wazuh-alerts-4.x-2021.01.09 1H1cpcMVQmKayLvLi5TnMA 3 0 152998 0 251.9mb 251.9mb

green open wazuh-monitoring-2021.03.09 oc1MzDcgQHCw8p5kil4ErA 2 0 1728 0 529.3kb 529.3kb

green open wazuh-statistics-2021.2w clAQRHT0Q8WQu1LjpASuOw 2 0 4028 0 1.3mb 1.3mb

green open wazuh-monitoring-2021.03.04 ricef3ZyQFW5p9rb9G-iGw 2 0 1558 0 670.1kb 670.1kb

green open wazuh-monitoring-2021.03.03 dPOjP1iQSrCSXFr5vJNpCg 2 0 1824 0 558.9kb 558.9kb

green open wazuh-monitoring-2021.03.06 hQE773P4SPqNQjAn6H78mA 2 0 1710 0 499.6kb 499.6kb

green open wazuh-monitoring-2021.03.05 K89yR6UuSYq_s1DqBeQPXQ 2 0 1156 0 598.5kb 598.5kb

green open wazuh-alerts-4.x-2021.01.14 FDrGhgcRQlyNtk4bjotvdg 3 0 173314 0 313.1mb 313.1mb

green open wazuh-alerts-4.x-2021.01.15 0_czmKHTS6CFE3FGs0PIxw 3 0 171404 0 309.7mb 309.7mb

green open wazuh-alerts-4.x-2021.01.12 tk_Z1-g-Q2aR9xJKEfeLvg 3 0 165993 0 299.1mb 299.1mb

green open wazuh-alerts-4.x-2021.01.13 xVPXVlrtQdWlGfRa76a_jA 3 0 170526 0 308.6mb 308.6mb

green open wazuh-alerts-4.x-2021.01.18 ymYlcdKVSiCQkt1j7mcm6A 3 0 173920 0 313.9mb 313.9mb

green open wazuh-alerts-4.x-2021.01.19 r_PFXHAASSW8woDtoALyzg 3 0 174342 0 315.4mb 315.4mb

green open wazuh-alerts-4.x-2021.01.16 AIH1m3ppTy-h61n-5uPwQA 3 0 134388 0 241.2mb 241.2mb

green open wazuh-alerts-4.x-2021.01.17 TkAl3fppSxeppAIVMyq6GQ 3 0 129220 0 230.7mb 230.7mb

green open .async-search RZX83bFwQ2aofVwwo_bKaQ 1 0 0 0 235b 235b

green open wazuh-alerts-4.x-2021.01.10 VaK_tioPTQegLONCqn02XA 3 0 130441 0 233.6mb 233.6mb

green open wazuh-alerts-4.x-2021.01.11 3jN4oy-8RPi373jCr6AmTQ 3 0 173554 0 308.8mb 308.8mb

green open wazuh-monitoring-2021.03.11 VhShrxzuQgms3IROHUp9ow 2 0 1728 0 528.5kb 528.5kb

green open wazuh-monitoring-2021.03.10 33ziy29dTruvY7fPeJO9Vg 2 0 1728 0 528.9kb 528.9kb

green open wazuh-monitoring-2021.03.13 UOnYYxOMTImg2084kbdotQ 2 0 1710 0 492.2kb 492.2kb

green open wazuh-monitoring-2021.03.12 Xd6pNUbySUejFmGH3Z6xRA 2 0 1728 0 530.6kb 530.6kb

green open wazuh-monitoring-2021.03.19 pQwrcQq0TS-g0ZzeyQetNQ 2 0 1728 0 532.8kb 532.8kb

green open wazuh-monitoring-2021.03.18 OkvqviN-Qjuw-JxVU0y6pw 2 0 1728 0 531kb 531kb

yellow open .items-default-000001 D2ZjppuBS9etPAqwe-qvFg 1 1 0 0 208b 208b

green open wazuh-monitoring-2021.03.15 Tx6eCZGTRrWWeJZtjKnPEA 2 0 1728 0 530.6kb 530.6kb

green open wazuh-monitoring-2021.03.14 MVl61GHHR5-oM2pDhTh33w 2 0 1728 0 531.2kb 531.2kb

green open wazuh-monitoring-2021.03.17 M5Y-Tg5PREqhFU0KPPMAnA 2 0 1728 0 530.6kb 530.6kb

green open wazuh-monitoring-2021.03.16 -CbaIrluSdmk6XB38cA0eA 2 0 1728 0 531.2kb 531.2kb

green open wazuh-alerts-4.x-2021.03.28 k4UVSqi0T3udwy1saTngGQ 3 0 223959 0 389.8mb 389.8mb

green open wazuh-alerts-4.x-2021.03.27 eiv3h8UXQ7ChUrPWkFEsTQ 3 0 139078 0 248.9mb 248.9mb

green open wazuh-alerts-4.x-2021.03.26 31QOlPwRQsumtof_f2tatg 3 0 169799 0 306.2mb 306.2mb

green open wazuh-alerts-4.x-2021.03.25 kzb8AxWQTU2zw3ChU3ddXg 3 0 208979 0 372.1mb 372.1mb

green open wazuh-alerts-4.x-2021.03.29 s_RV15aESwKdEuGVds-X8g 3 0 128193 0 229.4mb 229.4mb

green open wazuh-alerts-4.x-2021.03.20 dnilDUixR4yVXIY2ZTTe8w 3 0 155233 0 275.8mb 275.8mb

green open wazuh-alerts-4.x-2021.03.24 QbBLLlddSVWllHXj9fv5PA 3 0 179944 0 324.3mb 324.3mb

green open wazuh-alerts-4.x-2021.03.23 tUogvwxwQXaDkHj2Ie63DQ 3 0 167473 0 302.3mb 302.3mb

green open wazuh-alerts-4.x-2021.03.22 0EdFUmkASZWWEfS7u3yHpA 3 0 198574 0 353.4mb 353.4mb

green open wazuh-alerts-4.x-2021.03.21 h83q-qdhQECqVCZu38jFhQ 3 0 121385 0 215.8mb 215.8mb

green open wazuh-monitoring-2021.03.22 GyCnEUN-RBy9JlVDtrWEjg 2 0 1728 0 529.8kb 529.8kb

green open wazuh-monitoring-2021.03.21 uxjMBgj-TYifsne0gyA0qQ 2 0 1728 0 529kb 529kb

green open wazuh-monitoring-2021.03.24 PpiUvDVFR66N1aQcu_hoRg 2 0 1728 0 529.6kb 529.6kb

green open wazuh-monitoring-2021.03.23 HPY-bJ_-RgeWQiz3NI_VyA 2 0 1728 0 532.3kb 532.3kb

green open wazuh-monitoring-2021.03.20 p08F7F6ISFaGrUncU6UtCg 2 0 1728 0 526.3kb 526.3kb

green open .apm-agent-configuration mQkoEx5wQE6mE_dNOoBeQw 1 0 0 0 208b 208b

green open wazuh-monitoring-2021.03.29 ARBiFbyYSQSFz0EZ0Ipj5g 2 0 1044 0 351.2kb 351.2kb

green open wazuh-statistics-2020.52w vs8Uh014QXq_RiGw8A8t3g 2 0 894 0 532.7kb 532.7kb

green open wazuh-monitoring-2021.03.26 rXN_B03KSm-fXztXy20M8w 2 0 1728 0 530.3kb 530.3kb

green open wazuh-monitoring-2021.03.25 NF0mOW4SR1O1nDgnH73MPg 2 0 1728 0 528.9kb 528.9kb

green open wazuh-monitoring-2021.03.28 UI1JKXY8TceUGjkIHkXMmw 2 0 1728 0 530.3kb 530.3kb

green open wazuh-monitoring-2021.03.27 qvWtD8JDTOW3G7R2pJWs1Q 2 0 1728 0 530kb 530kb

green open wazuh-alerts-4.x-2021.03.17 d9AewMFGTD6uhKRkKc5sOQ 3 0 232730 0 413.7mb 413.7mb

green open wazuh-alerts-4.x-2021.03.16 iui2x2eiQvKjiHwJe9b0XA 3 0 219888 0 391.1mb 391.1mb

green open wazuh-alerts-4.x-2021.03.15 D2QNTQkzTwyKyREq49bsxw 3 0 167242 0 301.3mb 301.3mb

green open wazuh-alerts-4.x-2021.03.14 VcPPjUvDR3SDpvNQ_hwdwQ 3 0 120256 0 213.7mb 213.7mb

green open wazuh-alerts-4.x-2021.03.19 7puL8evcQvyIaVt2L1f4eQ 3 0 228538 0 406.6mb 406.6mb

green open wazuh-alerts-4.x-2021.03.18 RzM9xGnaRzqZ9jv8paBsKQ 3 0 249904 0 442.6mb 442.6mb

green open wazuh-alerts-4.x-2021.03.13 JMBrUtnDRmCWQNOr37RsLw 3 0 158192 0 281.5mb 281.5mb

green open wazuh-alerts-4.x-2021.03.12 Ycu1qWrOR9uH37aRKQWPKg 3 0 166718 0 301.4mb 301.4mb

green open wazuh-alerts-4.x-2021.03.11 qrU9Fz2_QdCUf4AiALND1w 3 0 183593 0 330.9mb 330.9mb

green open wazuh-alerts-4.x-2021.03.10 bL8O8FvBR-iVrftAvteWLg 3 0 173511 0 313.8mb 313.8mb

green open wazuh-statistics-2020.53w pSB2Hs3WQDyS5D9TIsYXUA 2 0 2299 0 730.9kb 730.9kb

green open wazuh-alerts-4.x-2021.03.06 yTjzTAWqQWCi8vEBb-3ETA 3 0 127225 0 226.7mb 226.7mb

green open wazuh-alerts-4.x-2021.03.05 pd-FvNn5TcK86hK7_Ia1Mg 3 0 201977 0 359.9mb 359.9mb

green open wazuh-alerts-4.x-2021.03.04 AO_PYJ-JQ5SX-ziDLnLnBQ 3 0 174166 0 312.7mb 312.7mb

green open wazuh-alerts-4.x-2021.03.03 0KU1pnOARqyFfNvsfkkRLA 3 0 179318 0 322.2mb 322.2mb

green open wazuh-alerts-4.x-2021.03.09 CFGzph-kT-mYyn32YKlf2g 3 0 172377 0 310.3mb 310.3mb

green open wazuh-alerts-4.x-2021.03.08 EK2kAkhMRlWEkvFtlWsyEQ 3 0 172339 0 310.3mb 310.3mb

green open wazuh-alerts-4.x-2021.03.07 r7DcX_ipS7KhCGi8-4ot4Q 3 0 121468 0 216.6mb 216.6mb

green open wazuh-alerts-4.x-2021.03.02 ymtjd42-Q1GxFVUTehebDQ 3 0 169854 0 306.6mb 306.6mb

green open wazuh-alerts-4.x-2021.03.01 FxQP7oQtR02ZgbeMijqVNQ 3 0 169337 0 305mb 305mb

green open wazuh-statistics-2021.10w DxGusjMVR5SziIA5bnhzMA 2 0 3736 0 1mb 1mb

green open .kibana_2 Uha0K-0yRY2d8j5VoSV3bg 1 0 453 55 10.7mb 10.7mb

green open .kibana_1 G-Xvob3WQFiqeN6KjL6RLw 1 0 19 13 10.4mb 10.4mb

green open wazuh-alerts-4.x-2021.02.26 -DZhmI8jQDKtPOBzzWsxDQ 3 0 187408 0 336.5mb 336.5mb

green open wazuh-alerts-4.x-2021.02.27 EFGMfxOlS3OI0CqHNkX6Dg 3 0 127266 0 227.5mb 227.5mb

green open wazuh-alerts-4.x-2021.02.24 SaRwi8NkToq-wHDR-WxLkg 3 0 185503 0 332.7mb 332.7mb

green open wazuh-alerts-4.x-2021.02.25 3bRK-QXvTSC-2JqRP10Weg 3 0 177653 0 320.2mb 320.2mb

green open wazuh-alerts-4.x-2021.02.28 0TYGo6R3Qg6xGpyxObNCAw 3 0 121891 0 217.3mb 217.3mb

green open wazuh-alerts-4.x-2021.02.22 CQLuY_RJSJakAcjd99Zizw 3 0 170890 0 306.5mb 306.5mb

green open wazuh-alerts-4.x-2021.02.23 _FZhSHE_Q3uQKX-_3f04hg 3 0 178428 0 319.3mb 319.3mb

green open wazuh-alerts-4.x-2021.02.20 6qeEWSxBT2CxaXTWY0nzgQ 3 0 126808 0 226.7mb 226.7mb

green open wazuh-alerts-4.x-2021.02.21 ke0DLLayTQapsfHWbZh7Iw 3 0 119522 0 212.9mb 212.9mb

green open wazuh-statistics-2021.11w ePJPkF5bSCi-DRiKR52XbQ 2 0 4025 0 1.1mb 1.1mb

green open wazuh-statistics-2021.7w Q21me7T0QJeDt0XLKFh3_Q 2 0 4025 0 1.2mb 1.2mb

green open .apm-custom-link MIyjIPJ1QwyYFj3J1jOZeA 1 0 0 0 208b 208b

green open .kibana_task_manager_1 mJn5PJuyQ-eBDHrWVIYSQA 1 0 6 53841 9.4mb 9.4mb

yellow open logs-index_pattern_placeholder wfsWFqDBTtKaMloutQBr7A 1 1 0 0 208b 208b

green open wazuh-statistics-2021.12w Lay7aACjTc6PA9VQKXhNNA 2 0 4027 0 1mb 1mb

green open wazuh-statistics-2021.8w u7pwKlN-RVG0Ox3mSp8_BQ 2 0 4030 0 1.2mb 1.2mb

yellow open metrics-index_pattern_placeholder zUwSgdseSjmTCMgbl0hG4A 1 1 0 0 208b 208b

green open wazuh-alerts-4.x-2020.12.26 GzUVu4LmTGKyzIoqw0GM_A 3 0 78030 0 143.5mb 143.5mb

green open wazuh-alerts-4.x-2020.12.27 r-4zxER4Q5O0foFLNwBbjA 3 0 136758 0 247.5mb 247.5mb

green open wazuh-statistics-2021.13w gMxr5gjFQFmbu4r0jj3SSg 2 0 4386 0 1.4mb 1.4mb

green open wazuh-alerts-4.x-2020.12.28 xTCiMjIpTkKA6tKo__BYrA 3 0 158307 0 284.7mb 284.7mb

green open wazuh-alerts-4.x-2020.12.29 I3fr_RyYTxi8K7ha5ug5hw 3 0 163970 0 294.8mb 294.8mb

green open wazuh-statistics-2021.9w -VUldmF1ToiQ-W3IAQkrIg 2 0 4024 0 1.2mb 1.2mb

green open wazuh-alerts-4.x-2020.12.30 nLsRRPs4S6GCDZD2D4JIEA 3 0 168586 0 301.8mb 301.8mb

green open wazuh-alerts-4.x-2020.12.31 _Seaq5QgRgqfQob55I-yJA 3 0 142484 0 254.7mb 254.7mb

green open .security-7 6CIHPI6SQoWhgHwGVsDVeg 1 0 49 0 156.6kb 156.6kb

green open .kibana-event-log-7.9.3-000002 ANCGm95-Qpu9M4MGeXoVuw 1 0 0 0 208b 208b

green open .kibana-event-log-7.9.3-000001 OnmXKeUsSMiIbaKt7VpCGQ 1 0 10 0 53.7kb 53.7kb

green open .kibana-event-log-7.9.3-000004 lRp9VujXQ8-rPwTdFFPDZQ 1 0 0 0 208b 208b

green open .kibana-event-log-7.9.3-000003 KxaW0evBRhKMYwhTWXtn-g 1 0 1 0 5.5kb 5.5kb

green open wazuh-statistics-2021.3w f-S_zNOlS0iYDwJYHLkGxA 2 0 4029 0 1.1mb 1.1mb

green open wazuh-monitoring-2020.12.31 ANtpoPbnQP6T7kOlXjF6ag 2 0 1824 0 550.1kb 550.1kb

green open wazuh-monitoring-2020.12.30 V4ue7JS8RmykZFexxcgH0g 2 0 1862 0 636.2kb 636.2kb

green open wazuh-alerts-4.x-2021.01.03 cFffw8NsTdKIVa9px4qezA 3 0 133496 0 237.3mb 237.3mb

green open wazuh-alerts-4.x-2021.01.04 QKxT7Kj8Rd6FWYaHxXyFyg 3 0 146357 0 262mb 262mb

green open wazuh-alerts-4.x-2021.01.01 S8332ZEUQUedu-cO9z9pDA 3 0 137020 0 244mb 244mb

green open wazuh-alerts-4.x-2021.01.02 UVVszHjQRA-EcugCXwOI4w 3 0 137003 0 243.9mb 243.9mb

green open wazuh-alerts-4.x-2021.01.07 8CbFfOcfSiGku2X1yCqChQ 3 0 160655 0 289mb 289mb

green open wazuh-alerts-4.x-2021.01.08 EVDAxfnGS-SCwMQiT6yFog 3 0 161485 0 290mb 290mb

green open wazuh-alerts-4.x-2021.01.05 2-lZL_63T4amzfG0vnKZBA 3 0 149727 0 268.1mb 268.1mb

green open wazuh-alerts-4.x-2021.01.06 ZkEZlwVdTbui44FEJFH2Sw 3 0 138005 0 246.9mb 246.9mb

green open wazuh-monitoring-2020.12.28 p4lj7wTtSQWGeLiUm7AN-Q 2 0 1805 0 504.5kb 504.5kb

green open wazuh-monitoring-2020.12.29 Ozd1-CNQT7-jA7CvI7w55w 2 0 1862 0 596.3kb 596.3kb

green open wazuh-monitoring-2020.12.26 E1rKny3kSVKi0ZtaVDMdEQ 2 0 974 0 519.2kb 519.2kb

green open wazuh-monitoring-2020.12.27 3_C9WRooRfmWuCPJNEB-aw 2 0 1843 0 589.5kb 589.5kb

green open wazuh-monitoring-2021.01.05 c4jHKRHrTniN4wu9k5em4Q 2 0 1824 0 547.6kb 547.6kb

green open wazuh-monitoring-2021.01.06 WsvWUQs2TgWKwLLiEJTblQ 2 0 1824 0 548.7kb 548.7kb

green open wazuh-statistics-2021.4w pdbJwQ03RL2ookVYWyRhQQ 2 0 4030 0 1.2mb 1.2mb

green open wazuh-monitoring-2021.01.07 kFGUvTl4RKyYHhAXxXz2kw 2 0 1824 0 552.2kb 552.2kb

green open wazuh-monitoring-2021.01.08 MaQwRCiKQ5iiEARwuc2jgg 2 0 1805 0 510.5kb 510.5kb

green open wazuh-monitoring-2021.01.01 y_0Q9SA5Tiic3NvtfWpqZA 2 0 1824 0 545.9kb 545.9kb

green open wazuh-monitoring-2021.01.02 gUwK2N1SSGCFWXOnl3YLbA 2 0 1824 0 546.2kb 546.2kb

green open wazuh-monitoring-2021.01.03 jtj5WovHR56xdsXsO87dZw 2 0 1824 0 542.9kb 542.9kb

green open wazuh-monitoring-2021.01.04 f8t4c5n6SpCeXlfie5yBHQ 2 0 1824 0 544.8kb 544.8kb

green open wazuh-monitoring-2021.01.10 gWy7D-PNQKGkIoGURhmt-A 2 0 1824 0 547.9kb 547.9kb

green open wazuh-monitoring-2021.01.11 7lPKHrFzQ8aZIIOvyd0YwA 2 0 1824 0 547kb 547kb

green open wazuh-monitoring-2021.01.16 9pVLsB0HRsGYcRH-LsjshQ 2 0 1824 0 545.9kb 545.9kb

green open wazuh-monitoring-2021.01.17 9QZ-M0KNQ1-ARqs8ikqouA 2 0 1824 0 544.5kb 544.5kb

green open wazuh-monitoring-2021.01.18 mBmDiq44Siu8xAB91OQn2g 2 0 1824 0 546.9kb 546.9kb

green open wazuh-monitoring-2021.01.19 0YF5P3nARh-GLcHym9mlFQ 2 0 1824 0 543.5kb 543.5kb

green open wazuh-monitoring-2021.01.12 -oYSXSGVRwSJbs5l9vWHLQ 2 0 1805 0 508.6kb 508.6kb

green open wazuh-monitoring-2021.01.13 MfNuRUIqRkqkoEuAX4-wKg 2 0 1843 0 590.2kb 590.2kb

green open wazuh-statistics-2021.5w _8TetQgERWSvw2wRsiSoxg 2 0 4021 0 1.2mb 1.2mb

green open wazuh-monitoring-2021.01.14 qSgIDU9rRu6mGkFdLmkrRg 2 0 1843 0 590.2kb 590.2kb

green open wazuh-monitoring-2021.01.15 N6Z-bgVYQwiVaE1ZRwJ_zw 2 0 1824 0 545.8kb 545.8kb

green open wazuh-monitoring-2021.01.09 EVroaQoPSSmL0GZO6Oq-JA 2 0 1824 0 552.1kb 552.1kb

green open wazuh-monitoring-2021.01.20 GkgAbJyrQiGmjFJ-5gVxyg 2 0 1824 0 541.1kb 541.1kb

green open wazuh-monitoring-2021.01.21 1wRxwuEdTeSKkDPfikW2TA 2 0 1824 0 542.3kb 542.3kb

green open wazuh-monitoring-2021.01.22 YHVpLVFISLi2jwluAMKwoQ 2 0 1824 0 559.8kb 559.8kb

yellow open .lists-default-000001 XT1oucmsSGyQ6dyM54W9Pg 1 1 0 0 208b 208b

green open wazuh-monitoring-2021.01.27 8DCL7H1-RBO2FVqbGNE3Ow 2 0 1824 0 559.6kb 559.6kb

green open wazuh-monitoring-2021.01.28 beAf9U40S3ugpjwD2yCYBw 2 0 1824 0 560.1kb 560.1kb

green open wazuh-monitoring-2021.01.29 4JsyCBtqQOK_AfbIfHfPLA 2 0 1805 0 517.6kb 517.6kb

green open wazuh-monitoring-2021.01.23 a_oimpb0S2qI-t7z3yy5iw 2 0 1824 0 567kb 567kb

green open wazuh-monitoring-2021.01.24 8BoorbKKR3G3fZv0Pog0sg 2 0 1824 0 565.1kb 565.1kb

green open wazuh-monitoring-2021.01.25 ZPEzwEE4SLaXDMfR8m8UCA 2 0 1824 0 564.1kb 564.1kb

green open wazuh-monitoring-2021.01.26 1kvrUDm3R1aAC2845be2pw 2 0 1824 0 566.2kb 566.2kb

green open wazuh-statistics-2021.6w QxQ--ogqSy2zVxQQvBD8OA 2 0 4030 0 1.2mb 1.2mb

Franco Charriol

unread,

Mar 29, 2021, 5:30:51 PM3/29/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio, thanks for the reply.

I notice you don't have the index wazuh-alerts-000001 that I mention in a previous reply.

Also, there are "old" indices, are they from the new server that you mentioned?

If this is the case, maybe my new instance is too new to reproduce the problem.

All posts that I found about this problem were solved by adding the rollover_alias and creating the bootstrap index how I mentioned before.

However, if permissions are no the problem and when you create the new index wazuh-alerts-000001 the error remains, maybe the Kibana index could be having some problems causing this bad behavior.

You could try to backup your entire saved objects from Kibana, please do it by exporting little chunks of items to avoid re-importing problems

Then you'll be able (under your own responsibility) to remove the index .kibana, you could do this through the Elastic API and Kibana service down.

After restart the Kibana service the index will be created again, then you should re-import all saved objects.

Best

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/2588068e-850c-4da7-ae72-55dff3065ce2n%40googlegroups.com.

Fabio Miotti

unread,

Mar 30, 2021, 5:04:41 AM3/30/21

to Wazuh mailing list

Hi Franco

i have done from the command from production test because i have deleted the server test with your suggestions because the problem was not solved

i stop the test and i will delete manually all indexes when the disk will be busied.

thanks for your time

Franco Charriol

unread,

Mar 30, 2021, 11:07:33 AM3/30/21

to Fabio Miotti, Wazuh mailing list

Hi Fabio,

I understand, please let me know if you try occasionally removing the .kibana index for any feedback about the results.

If I find something else I will let you know

Kind regards

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/18437fa0-23f4-4957-8205-237530d4af3cn%40googlegroups.com.

Reply all

Reply to author

Forward