Index location and log path change

[Smriti Kaushal]

Hi

Is there any way to change the log file location and index location in wazuh .

[Benjamin Nworah]

Hello Smritiki,

Thank you for using Wazuh!

I will recommend you take a look at this link.

Please let me know if this answers your question.

Regards,

[Smriti Kaushal]

hi

thank you for the information.

I understand that we can move the logs from one place to other.

Is it possible to move the entire index to some other location?

[Benjamin Nworah]

Hello Smiritika,

Please give me some time to revert back.
Regards,

[Smriti Kaushal]

sure, Thanks

[Benjamin Nworah]

Hello smiritika,

Please what is your environment model?

- Do you have All-in-one or distributed?

- Are your running Wazuh indexer, or elastic search?
Regards,

[Smriti Kaushal]

I am using wazuh indexer

[Benjamin Nworah]

Hello Smirika,

Thank you for your swift response.

To change the index in wazuh-indexer, kindly follow the below steps:

1. Stop indexing and perform flush: curl -X POST "https://<indexer_IP>:9200/_flush/synced" -u <username>:<password> -k
2. Stop filebeat systemctl stop filebeat
3. Stop wazuh-indexer: systemctl stop wazuh-indexer
4. Move or copy your data to the new directories and change ownership.

                 # mv /var/lib/wazuh-indexer/ /<new_folder_lib>/
                # mv /var/log/wazuh-indexer/ /<new folder_log>/
                # chown wazuh-indexer:wazuh-indexer -R /<new_folder_lib>/
                # chown wazuh-indexer:wazuh-indexer -R /<new folder_log>/

        5. edit /etc/wazuh-indexer/opensearch.yml

        6. Change path.data and path.logs to the new partitions

        7. Restart the services
            #systemctl daemon-reload

           #systemctl enable wazuh-indexer
           #systemctl start wazuh-indexer

           #systemctl restart filebeat

Please let me know if this helps.

Regards,

[Smriti Kaushal]

thank you for your time and help,

I tried but it didn't work

[Benjamin Nworah]

Hello smritika,

Did you receive any error message while migrating the index logs.?

I tested it on my All-in-one lab, and it worked.

Please replace these steps:
I included "*"

-  # mv /var/lib/wazuh-indexer/ /<new_folder_lib>/ with  # mv /var/lib/wazuh-indexer/* /<new_folder_lib>/ 

- # mv /var/log/wazuh-indexer/ /<new folder_log>/  with # mv /var/log/wazuh-indexer/* /<new folder_log>/

Part of what worked for me, try and create the new directories inside the folder /var/log/ and /var/lib, for example.

mkdir /var/lib/<new_folder_lib>
mkdir /var/log/<new_folder_log>

Please let me know if this works. I will be here waiting.

Regards,

[TheLotus 24]

Hello, and to test in a distributed environment?