Failed to start Wazuh-indexer

[Arby]

Hello,

Can you help me with my indexer?. I did stop my instance for a while and when it's running again I can't access Wazuh dashboard "Wazuh dashboard server is not ready yet". I did some googling and point me out to my indexer not running, this is my only clue as to why I can't access my Dashboard.

wazuh-indexer.service - Wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2023-09-23 11:21:43 UTC; 18s ago
     Docs: https://documentation.wazuh.com
  Process: 6920 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=1/FAILURE)
 Main PID: 6920 (code=exited, status=1/FAILURE)

Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: at org.opensearch.cli.Command.main(Command.java:101)
Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Sep 23 11:21:42 wazuh-server systemd-entrypoint[6920]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.log
Sep 23 11:21:43 wazuh-server systemd[1]: wazuh-indexer.service: main process exited, code=exited, status=1/FAILURE
Sep 23 11:21:43 wazuh-server systemd[1]: Failed to start Wazuh-indexer.
Sep 23 11:21:43 wazuh-server systemd[1]: Unit wazuh-indexer.service entered failed state.
Sep 23 11:21:43 wazuh-server systemd[1]: wazuh-indexer.service failed.

[Raul Del Pozo Moreno]

Hello Arby

Please run the following commands and attach the files with the output (journal.log and indexer.log)

• journalctl -r -u wazuh-indexer > journal.log
• grep -R -i -E "error|critical|fatal|warning" /var/log/wazuh-indexer > indexer.log

What version of Wazuh are you using? You can know this with the following command:

• cat /usr/share/wazuh-indexer/VERSION