Failed to sync agents After upgrade

391 views

Skip to first unread message

Marcelo Dimargo

unread,

Jul 24, 2024, 3:52:26 AM7/24/24

to Wazuh | Mailing List

hi team,

I have a wazuh 4.8 all in one over ubuntu server(one manager, one indexer, etc all in same server ) with 45 agents. I did an upgrade from 4.7.5 with the https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html . All work fine, but vulnerabilities are not update as before and I have a lot of error over ossec.log like . I mean the agent are showed as active and sync

2024/07/23 11:17:17 indexer-connector: WARNING: Failed to sync agent '046' with the indexer.
2024/07/23 11:18:36 indexer-connector: WARNING: Failed to sync agent '048' with the indexer.
2024/07/23 11:19:02 indexer-connector: WARNING: Failed to sync agent '041' with the indexer.

My conf over path of certs and Ossec.conf is as documentation

root@serverwazuh:/home/usuario# ls -la /etc/filebeat/certs/
total 20
dr-x------ 2 root root 4096 ago 2 2023 .
drwxr-xr-x 4 root root 4096 nov 21 2023 ..
-r-------- 1 root root 1204 ago 2 2023 root-ca.pem
-r-------- 1 root root 1704 ago 2 2023 wazuh-server-key.pem
-r-------- 1 root root 1285 ago 2 2023 wazuh-server.pem
root@serverwazuh:/home/ usuario # cat /var/ossec/etc/ossec.conf | grep "<indexer>" -A12
<indexer>
<enabled>yes</enabled>
<hosts>
<host>https://127.0.0.1:9200</host>
</hosts>
<ssl>
<certificate_authorities>
<ca>/etc/filebeat/certs/root-ca.pem</ca>
</certificate_authorities>
<certificate>/etc/filebeat/certs/wazuh-server.pem</certificate>
<key>/etc/filebeat/certs/wazuh-server-key.pem</key>
</ssl>
</indexer>

root@serverwazuh:/home/ usuario # cat /var/ossec/etc/ossec.conf | grep "<vulnerability-detection>" -A12
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

with wazuh_modules.debug=2
2024/07/23 12:17:18 wazuh-modulesd:vulnerability-scanner[838839] versionMatcher.hpp:200 at createVersionObject(): DEBUG: Error creating VersionObject (DPKG). Version string doesn't match the specified type. Version string: r2

2024/07/23 12:17:18 wazuh-modulesd:vulnerability-scanner[838839] osScanner.hpp:255 at operator()(): DEBUG: Failed to scan OS: 'windows_server_2008', CVE Numbering Authorities (CNA): 'nvd', Error: 'Unable to compare versions (6.1.7601 vs r2).'
2024/07/23 12:17:40 indexer-connector[838839] indexerConnector.cpp:446 at operator()(): WARNING: Failed to sync agent '046' with the indexer.
2024/07/23 12:17:40 indexer-connector[838839] indexerConnector.cpp:447 at operator()(): DEBUG: Error: No available server

root@serverwazuh:/home/usuario# curl -k -u admin:pass https://localhost:9200/_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles cluster_manager name
192.168.80.33 66 99 33 1.23 1.35 1.39 dimr cluster_manager,data,ingest,remote_cluster_client * node-1
root@serverwazuh:/home/usuario# curl -k -u admin:pass https://localhost:9200/_cat/health?v
epoch timestamp cluster status node.total node.data discovered_cluster_manager shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1721748596 15:29:56 wazuh-cluster yellow

a curl with certificates:

curl -u admin:passb* --cacert /etc/filebeat/certs/root-ca.pem --cert /etc/filebeat/certs/wazuh-server.pem --key /etc/filebeat/certs/wazuh-server-key.pem -X GET "https://127.0.0.1:9200/_cluster/health?pretty"
{
"cluster_name" : "wazuh-cluster",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 201,
"active_shards" : 201,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 27,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 88.1578947368421

The only index with yelow status over Index Managemente>indexes> is .opendistro-job-scheduler-lock . attached.

filebeat test output
elasticsearch: https://127.0.0.1:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 127.0.0.1
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2

journalctl -u wazuh-dashboard | grep -iE "err|warn" (a lot of this msg)
jul 23 11:00:58 serverwazuh opensearch-dashboards[926]: {"type":"log","@timestamp":"2024-07-23T14:00:58Z","tags":["error","opensearch","data"],"pid":926,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
jul 23 11:19:14 serverwazuh opensearch-dashboards[834911]: {"type":"error","@timestamp":"2024-07-23T14:19:14Z","tags":["connection","client","error"],"pid":834911,"level":"error","error":{"message":"C077C9A8997F0000:error:0A000416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 46\n","name":"Error","stack":"Error: C077C9A8997F0000:error:0A000416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 46\n","code":"ERR_SSL_SSLV3_ALERT_CERTIFICATE_UNKNOWN"},"message":"C077C9A8997F0000:error:0A000416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 46\n"}

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -iE 'WARN|ERR'
[2024-07-23T04:23:34,355][ERROR][o.o.a.a.AlertIndices ] [node-1] info deleteOldIndices
[2024-07-23T04:23:34,355][ERROR][o.o.a.a.AlertIndices ] [node-1] info deleteOldIndices
[2024-07-23T11:00:04,972][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:05,931][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:05,935][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-4]
[2024-07-23T11:00:05,766][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:07,066][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:07,081][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:07,455][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:07,460][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:09,218][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:09,226][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:14,561][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:14,572][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:15,957][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:15,960][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:21,172][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock
[2024-07-23T11:00:21,175][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-3]
[2024-07-23T11:00:33,100][INFO ][o.o.n.Node ] [node-1] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -Xms6g, -Xmx6g, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-18374615371988432769, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=3221225472, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]
[2024-07-23T11:00:54,624][WARN ][o.o.s.c.Salt ] [node-1] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes
[2024-07-23T11:00:54,700][ERROR][o.o.s.a.s.SinkProvider ] [node-1] Default endpoint could not be created, auditlog will not work properly.
[2024-07-23T11:00:54,701][WARN ][o.o.s.a.r.AuditMessageRouter] [node-1] No default storage available, audit log may not work properly. Please check configuration.
[2024-07-23T11:00:56,375][WARN ][o.o.s.p.SQLPlugin ] [node-1] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
[2024-07-23T11:00:58,097][WARN ][o.o.g.DanglingIndicesState] [node-1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2024-07-23T11:00:59,988][ERROR][o.o.s.t.SecurityRequestHandler] [node-1] OpenSearchException[Transport client authentication no longer supported.]
[2024-07-23T11:00:59,988][ERROR][o.o.s.t.SecurityRequestHandler] [node-1] OpenSearchException[Transport client authentication no longer supported.]
[2024-07-23T11:01:00,006][WARN ][o.o.d.HandshakingTransportAddressConnector] [node-1] handshake failed for [connectToRemoteMasterNode[[::1]:9300]]
at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]
[2024-07-23T11:01:00,003][WARN ][o.o.d.HandshakingTransportAddressConnector] [node-1] handshake failed for [connectToRemoteMasterNode[127.0.0.1:9300]]
at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]
[2024-07-23T11:01:00,045][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [node-1] Config override setting update called with empty string. Ignoring.
[2024-07-23T11:01:00,320][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] get managed-index failed: NoShardAvailableActionException[No shard available for [org.opensearch.action.get.MultiGetShardRequest@74023d0]]
[2024-07-23T11:01:00,347][WARN ][o.o.o.i.ObservabilityIndex] [node-1] message: index [.opensearch-observability/S5Iu5XO-SvuK8ugCjA6m8Q] already exists
[2024-07-23T11:01:00,357][WARN ][o.o.s.SecurityAnalyticsPlugin] [node-1] Failed to initialize LogType config index and builtin log types
[2024-07-23T11:01:00,359][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] Failed to get ISM policies with templates: Failed to execute phase [query], all shards failed

/etc/filebeat/filebeat.yml

# Wazuh - Filebeat configuration file
output.elasticsearch.hosts:
- 127.0.0.1:9200
# - <elasticsearch_ip_node_2>:9200
# - <elasticsearch_ip_node_3>:9200

output.elasticsearch:
protocol: https
username: ${username}
password: ${password}
ssl.certificate_authorities:
- /etc/filebeat/certs/root-ca.pem
ssl.certificate: "/etc/filebeat/certs/wazuh-server.pem"
ssl.key: "/etc/filebeat/certs/wazuh-server-key.pem"
setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.ilm.overwrite: true
setup.ilm.enabled: false

filebeat.modules:
- module: wazuh
alerts:
enabled: true
archives:
enabled: false

logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644

logging.metrics.enabled: false

seccomp:
default_action: allow
syscalls:
- action: allow
names:
- rseq

root@wazuhserver:/home/usuario# /var/ossec/bin/cluster_control -i more
ERROR: Cluster is not running. (I have one server , all in one so I thinks it is ok )

df -h show only 23% used

And some comands related to yellow status that I find with similar issue:

curl -k -u admin:pass -X GET "https://127.0.0.1:9200/_cluster/allocation/explain?pretty&include_disk_info=true"
{
"index" : ".opendistro-ism-managed-index-history-2024.07.21-000314",
"shard" : 0,
"primary" : false,
"current_state" : "unassigned",
"unassigned_info" : {
"reason" : "CLUSTER_RECOVERED",
"at" : "2024-07-23T14:01:00.071Z",
"last_allocation_status" : "no_attempt"
},
"cluster_info" : {
"nodes" : {
"VTV6O3A9SGKtuG_iZqxHOw" : {
"node_name" : "node-1",
"least_available" : {
"path" : "/var/lib/wazuh-indexer/nodes/0",
"total_bytes" : 1079529005056,
"used_bytes" : 278870740992,
"free_bytes" : 800658264064,
"free_disk_percent" : 74.2,
"used_disk_percent" : 25.8
},
"most_available" : {
"path" : "/var/lib/wazuh-indexer/nodes/0",
"total_bytes" : 1079529005056,
"used_bytes" : 278870740992,
"free_bytes" : 800658264064,
"free_disk_percent" : 74.2,
"used_disk_percent" : 25.8
}
}
},
"shard_sizes" : {
"[wazuh-alerts-4.x-2024.07.09][2][p]_bytes" : 401594787,
"[wazuh-alerts-4.x-2024.06.17][0][p]_bytes" : 143955367,
"[wazuh-alerts-4.x-2024.06.15][0][p]_bytes" : 167405612,
"[wazuh-alerts-4.x-2024.07.07][2][p]_bytes" : 159424854,
"[wazuh-alerts-4.x-2024.06.30][1][p]_bytes" : 148205253,
"[wazuh-statistics-2024.25w][0][p]_bytes" : 1809275,
"[wazuh-alerts-4.x-2024.06.12][2][p]_bytes" : 316763773,
"[wazuh-monitoring-2024.30w][0][p]_bytes" : 1344814,
"[wazuh-alerts-4.x-2024.06.10][2][p]_bytes" : 316654404,
"[wazuh-alerts-4.x-2024.06.14][2][p]_bytes" : 286556642,
"[wazuh-alerts-4.x-2024.07.11][0][p]_bytes" : 456715180,
"[wazuh-alerts-4.x-2024.06.16][2][p]_bytes" : 151311789,
"[wazuh-alerts-4.x-2024.07.08][0][p]_bytes" : 344686988,
"[wazuh-alerts-4.x-2024.07.13][0][p]_bytes" : 131093661,
"[wazuh-alerts-4.x-2024.07.06][0][p]_bytes" : 205713162,
"[.opendistro-ism-managed-index-history-2024.07.19-000312][0][p]_bytes" : 14476,
"[.opendistro-ism-managed-index-history-2024.06.27-000293][0][p]_bytes" : 14444,
"[.opendistro-ism-managed-index-history-2024.07.04-000299][0][p]_bytes" : 14460,
"[wazuh-alerts-4.x-2024.07.21][1][p]_bytes" : 155611736,
"[wazuh-alerts-4.x-2024.07.10][2][p]_bytes" : 382404066,
"[wazuh-alerts-4.x-2024.07.01][2][p]_bytes" : 343976600,
"[.opendistro-ism-managed-index-history-2024.07.09-000303][0][p]_bytes" : 13412,
"[wazuh-alerts-4.x-2024.07.03][2][p]_bytes" : 302586628,
"[wazuh-alerts-4.x-2024.07.23][1][p]_bytes" : 255723789,
"[wazuh-alerts-4.x-2024.07.05][2][p]_bytes" : 317846722,
"[wazuh-alerts-4.x-2024.06.19][0][p]_bytes" : 273510262,
"[wazuh-alerts-4.x-2024.06.11][0][p]_bytes" : 309469163,
"[wazuh-alerts-4.x-2024.06.13][0][p]_bytes" : 282241634,
"[wazuh-alerts-4.x-2024.06.20][0][p]_bytes" : 176149151,
"[wazuh-alerts-4.x-2024.06.22][0][p]_bytes" : 159688181,
"[wazuh-alerts-4.x-2024.07.12][2][p]_bytes" : 307472821,
"[wazuh-alerts-4.x-2024.07.16][2][p]_bytes" : 258712321,
"[wazuh-alerts-4.x-2024.07.14][2][p]_bytes" : 157489696,
"[wazuh-alerts-4.x-2024.06.06][0][p]_bytes" : 336914959,
"[wazuh-alerts-4.x-2024.07.18][1][p]_bytes" : 295129871,
"[wazuh-alerts-4.x-2024.06.23][1][p]_bytes" : 240670175,
"[.opendistro-ism-managed-index-history-2024.07.10-000304][0][p]_bytes" : 36462,
"[wazuh-alerts-4.x-2024.07.20][0][p]_bytes" : 179660171,
"[.opendistro-ism-config][0][p]_bytes" : 757373,
"[.opendistro-ism-managed-index-history-2024.07.20-000313][0][p]_bytes" : 14460,
"[.kibana_1][0][p]_bytes" : 51837,
"[wazuh-alerts-4.x-2024.07.02][0][p]_bytes" : 366105515,
"[.opendistro-ism-managed-index-history-2024.07.01-000296][0][p]_bytes" : 29651,
"[wazuh-alerts-4.x-2024.07.17][0][p]_bytes" : 274874183,
"[wazuh-alerts-4.x-2024.06.21][2][p]_bytes" : 138781643,
"[wazuh-alerts-4.x-2024.06.25][2][p]_bytes" : 71950601,
"[wazuh-alerts-4.x-2024.06.18][2][p]_bytes" : 323224407,
"[wazuh-alerts-4.x-2024.06.07][2][p]_bytes" : 275701630,
"[wazuh-alerts-4.x-2024.07.04][1][p]_bytes" : 345758482,
"[wazuh-alerts-4.x-2024.06.27][1][p]_bytes" : 309303432,
"[wazuh-alerts-4.x-2024.06.16][1][p]_bytes" : 153856163,
"[wazuh-monitoring-2024.24w][0][p]_bytes" : 5690883,
"[wazuh-alerts-4.x-2024.06.11][1][p]_bytes" : 310464766,
"[wazuh-alerts-4.x-2024.06.14][1][p]_bytes" : 277763077,
"[.opendistro-ism-managed-index-history-2024.06.28-000294][0][p]_bytes" : 14436,
"[wazuh-alerts-4.x-2024.07.06][1][p]_bytes" : 204439170,
"[wazuh-alerts-4.x-2024.07.09][1][p]_bytes" : 403739237,
"[.plugins-ml-config][0][p]_bytes" : 4019,
"[.opendistro-ism-managed-index-history-2024.07.03-000298][0][p]_bytes" : 14468,
"[.opendistro-ism-managed-index-history-2024.07.12-000306][0][p]_bytes" : 14460,
"[wazuh-statistics-2024.27w][0][p]_bytes" : 1780102,
"[wazuh-alerts-4.x-2024.06.28][2][p]_bytes" : 295884416,
"[wazuh-alerts-4.x-2024.07.01][1][p]_bytes" : 343814728,
"[wazuh-alerts-4.x-2024.07.03][1][p]_bytes" : 306956759,
"[wazuh-alerts-4.x-2024.07.14][1][p]_bytes" : 159011014,
"[wazuh-alerts-4.x-2024.07.12][1][p]_bytes" : 306391360,
"[wazuh-alerts-4.x-2024.06.17][1][p]_bytes" : 145395156,
"[wazuh-alerts-4.x-2024.06.19][1][p]_bytes" : 273325426,
"[wazuh-alerts-4.x-2024.06.08][1][p]_bytes" : 176459952,
"[wazuh-alerts-4.x-2024.06.06][1][p]_bytes" : 334144899,
"[wazuh-alerts-4.x-2024.07.21][2][p]_bytes" : 155815796,
"[wazuh-alerts-4.x-2024.07.23][2][p]_bytes" : 293900695,
"[.opendistro-ism-managed-index-history-2024.07.07-000302][0][p]_bytes" : 50076,
"[wazuh-alerts-4.x-2024.07.18][2][p]_bytes" : 296143317,
"[wazuh-alerts-4.x-2024.06.08][0][p]_bytes" : 169662541,
"[.tasks][0][p]_bytes" : 30531,
"[wazuh-alerts-4.x-2024.06.05][0][p]_bytes" : 389049403,
"[wazuh-alerts-4.x-2024.06.25][1][p]_bytes" : 68826271,
"[wazuh-alerts-4.x-2024.07.17][1][p]_bytes" : 277584976,
"[wazuh-alerts-4.x-2024.06.22][1][p]_bytes" : 161345096,
"[wazuh-alerts-4.x-2024.06.20][2][p]_bytes" : 171143900,
"[.kibana_2][0][p]_bytes" : 334351,
"[wazuh-monitoring-2024.29w][0][p]_bytes" : 5503340,
"[wazuh-alerts-4.x-2024.07.19][0][p]_bytes" : 251695880,
"[.opendistro-ism-managed-index-history-2024.07.14-000308][0][p]_bytes" : 23255,
"[wazuh-alerts-4.x-2024.07.03][0][p]_bytes" : 299325229,
"[wazuh-alerts-4.x-2024.06.23][2][p]_bytes" : 242708942,
"[wazuh-alerts-4.x-2024.06.09][2][p]_bytes" : 145014255,
"[wazuh-alerts-4.x-2024.07.22][0][p]_bytes" : 282870880,
"[wazuh-alerts-4.x-2024.07.20][1][p]_bytes" : 179768258,
"[wazuh-monitoring-2024.26w][0][p]_bytes" : 4357208,
"[wazuh-statistics-2024.24w][0][p]_bytes" : 1720577,
"[wazuh-alerts-4.x-2024.07.04][2][p]_bytes" : 344210296,
"[wazuh-alerts-4.x-2024.06.30][0][p]_bytes" : 144735048,
"[wazuh-alerts-4.x-2024.06.27][0][p]_bytes" : 306282327,
"[wazuh-alerts-4.x-2024.07.15][2][p]_bytes" : 258050024,
"[wazuh-statistics-2024.29w][0][p]_bytes" : 1723885,
"[wazuh-alerts-4.x-2024.07.08][2][p]_bytes" : 343963100,
"[wazuh-alerts-4.x-2024.06.16][0][p]_bytes" : 150213554,
"[.opendistro-ism-managed-index-history-2024.07.23-000315][0][p]_bytes" : 208,
"[wazuh-alerts-4.x-2024.06.11][2][p]_bytes" : 310366009,
"[wazuh-alerts-4.x-2024.06.13][2][p]_bytes" : 276890277,
"[.opendistro-ism-managed-index-history-2024.07.06-000301][0][p]_bytes" : 14444,
"[wazuh-alerts-4.x-2024.06.15][2][p]_bytes" : 164365098,
"[wazuh-alerts-4.x-2024.07.09][0][p]_bytes" : 405549757,
"[.opensearch-observability][0][p]_bytes" : 208,
"[wazuh-alerts-4.x-2024.07.12][0][p]_bytes" : 305707194,
"[.opensearch-sap-log-types-config][0][p]_bytes" : 100104,
"[wazuh-alerts-4.x-2024.07.10][0][p]_bytes" : 381798549,
"[wazuh-alerts-4.x-2024.06.19][2][p]_bytes" : 271349284,
"[wazuh-alerts-4.x-2024.07.14][0][p]_bytes" : 158784602,
"[wazuh-alerts-4.x-2024.06.17][2][p]_bytes" : 147079336,
"[wazuh-monitoring-2024.25w][0][p]_bytes" : 5688614,
"[wazuh-alerts-4.x-2024.06.06][2][p]_bytes" : 339040209,
"[wazuh-alerts-4.x-2024.06.08][2][p]_bytes" : 173267033,
"[wazuh-alerts-4.x-2024.06.28][1][p]_bytes" : 298220317,
"[.opendistro-ism-managed-index-history-2024.07.11-000305][0][p]_bytes" : 14516,
"[wazuh-alerts-4.x-2024.06.25][0][p]_bytes" : 70520521,
"[.opendistro-ism-managed-index-history-2024.06.26-000292][0][p]_bytes" : 14460,
"[wazuh-alerts-4.x-2024.06.07][0][p]_bytes" : 281264227,
"[.opendistro-ism-managed-index-history-2024.07.15-000309][0][p]_bytes" : 43961,
"[wazuh-alerts-4.x-2024.07.19][1][p]_bytes" : 252115152,
"[wazuh-alerts-4.x-2024.06.20][1][p]_bytes" : 173630456,
"[.opendistro-ism-managed-index-history-2024.07.18-000311][0][p]_bytes" : 14516,
"[.kibana_4][0][p]_bytes" : 278939,
"[wazuh-alerts-4.x-2024.06.04][2][p]_bytes" : 361924628,
"[wazuh-statistics-2024.26w][0][p]_bytes" : 1736230,
"[wazuh-statistics-2024.30w][0][p]_bytes" : 796756,
"[wazuh-alerts-4.x-2024.07.01][0][p]_bytes" : 343966309,
"[wazuh-alerts-4.x-2024.06.22][2][p]_bytes" : 155616245,
"[wazuh-alerts-4.x-2024.07.16][0][p]_bytes" : 267487026,
"[.opendistro-reports-instances][0][p]_bytes" : 6874,
"[wazuh-alerts-4.x-2024.06.26][2][p]_bytes" : 293403244,
"[wazuh-alerts-4.x-2024.07.05][0][p]_bytes" : 309184921,
"[wazuh-monitoring-2024.28w][0][p]_bytes" : 5247603,
"[.opensearch-notifications-config][0][p]_bytes" : 208,
"[.opendistro-ism-managed-index-history-2024.07.17-000310][0][p]_bytes" : 21735,
"[wazuh-alerts-4.x-2024.07.15][1][p]_bytes" : 250845386,
"[wazuh-alerts-4.x-2024.07.11][1][p]_bytes" : 461993614,
"[wazuh-alerts-4.x-2024.06.09][1][p]_bytes" : 139588589,
"[.opendistro-ism-managed-index-history-2024.07.02-000297][0][p]_bytes" : 14436,
"[wazuh-alerts-4.x-2024.07.02][2][p]_bytes" : 364354591,
"[wazuh-alerts-4.x-2024.06.10][0][p]_bytes" : 314119384,
"[wazuh-alerts-4.x-2024.07.20][2][p]_bytes" : 178660935,
"[wazuh-alerts-4.x-2024.07.22][1][p]_bytes" : 286353712,
"[wazuh-alerts-4.x-2024.06.21][0][p]_bytes" : 139481533,
"[wazuh-alerts-4.x-2024.06.29][0][p]_bytes" : 177232144,
"[wazuh-alerts-4.x-2024.06.05][1][p]_bytes" : 387236395,
"[wazuh-alerts-4.x-2024.07.06][2][p]_bytes" : 206770590,
"[wazuh-alerts-4.x-2024.06.14][0][p]_bytes" : 286314101,
"[wazuh-alerts-4.x-2024.06.18][0][p]_bytes" : 322851018,
"[wazuh-alerts-4.x-2024.07.17][2][p]_bytes" : 275879189,
"[wazuh-alerts-4.x-2024.07.13][2][p]_bytes" : 130953946,
"[wazuh-alerts-4.x-2024.06.10][1][p]_bytes" : 317419209,
"[wazuh-alerts-4.x-2024.06.12][1][p]_bytes" : 317354367,
"[.opendistro-ism-managed-index-history-2024.07.05-000300][0][p]_bytes" : 14476,
"[wazuh-alerts-4.x-2024.06.13][1][p]_bytes" : 280725062,
"[wazuh-alerts-4.x-2024.06.15][1][p]_bytes" : 166849029,
"[wazuh-alerts-4.x-2024.07.07][1][p]_bytes" : 160404255,
"[wazuh-alerts-4.x-2024.06.30][2][p]_bytes" : 144520320,
"[wazuh-alerts-4.x-2024.07.08][1][p]_bytes" : 345982994,
"[wazuh-alerts-4.x-2024.06.29][2][p]_bytes" : 177986021,
"[wazuh-alerts-4.x-2024.07.23][0][p]_bytes" : 233350261,
"[wazuh-monitoring-2024.27w][0][p]_bytes" : 5600344,
"[.opendistro_security][0][p]_bytes" : 43948,
"[wazuh-alerts-4.x-2024.07.21][0][p]_bytes" : 152655907,
"[wazuh-alerts-4.x-2024.07.05][1][p]_bytes" : 313693466,
"[wazuh-alerts-4.x-2024.07.10][1][p]_bytes" : 382739465,
"[wazuh-alerts-4.x-2024.07.16][1][p]_bytes" : 269273448,
"[.opendistro-ism-managed-index-history-2024.06.23-000291][0][p]_bytes" : 32204,
"[wazuh-alerts-4.x-2024.06.28][0][p]_bytes" : 298798150,
"[wazuh-alerts-4.x-2024.06.26][0][p]_bytes" : 294529429,
"[.opendistro-reports-definitions][0][p]_bytes" : 208,
"[.opendistro-ism-managed-index-history-2024.07.21-000314][0][p]_bytes" : 52724,
"[wazuh-alerts-4.x-2024.06.04][1][p]_bytes" : 361651283,
"[wazuh-alerts-4.x-2024.06.09][0][p]_bytes" : 143840497,
"[wazuh-alerts-4.x-2024.06.04][0][p]_bytes" : 362038678,
"[wazuh-alerts-4.x-2024.06.21][1][p]_bytes" : 139864224,
"[wazuh-alerts-4.x-2024.06.26][1][p]_bytes" : 290937752,
"[.opendistro-job-scheduler-lock][0][p]_bytes" : 222489,
"[wazuh-alerts-4.x-2024.06.05][2][p]_bytes" : 386749404,
"[.kibana_3][0][p]_bytes" : 273250,
"[wazuh-alerts-4.x-2024.07.18][0][p]_bytes" : 294026157,
"[wazuh-statistics-2024.28w][0][p]_bytes" : 1617654,
"[wazuh-alerts-4.x-2024.07.04][0][p]_bytes" : 347703001,
"[wazuh-alerts-4.x-2024.06.27][2][p]_bytes" : 306754346,
"[wazuh-alerts-4.x-2024.07.15][0][p]_bytes" : 254181422,
"[wazuh-alerts-4.x-2024.07.07][0][p]_bytes" : 157605768,
"[wazuh-alerts-4.x-2024.07.02][1][p]_bytes" : 365311446,
"[.opendistro-ism-managed-index-history-2024.06.29-000295][0][p]_bytes" : 37447,
"[wazuh-alerts-4.x-2024.06.29][1][p]_bytes" : 180386224,
"[wazuh-alerts-4.x-2024.07.13][1][p]_bytes" : 130602571,
"[wazuh-alerts-4.x-2024.06.18][1][p]_bytes" : 324445183,
"[wazuh-alerts-4.x-2024.06.07][1][p]_bytes" : 273791330,
"[wazuh-alerts-4.x-2024.07.22][2][p]_bytes" : 285335940,
"[.opendistro-ism-managed-index-history-2024.07.13-000307][0][p]_bytes" : 14468,
"[wazuh-alerts-4.x-2024.06.12][0][p]_bytes" : 317005470,
"[wazuh-alerts-4.x-2024.06.23][0][p]_bytes" : 237593270,
"[wazuh-alerts-4.x-2024.07.19][2][p]_bytes" : 252741683,
"[wazuh-alerts-4.x-2024.07.11][2][p]_bytes" : 459446866,
"[wazuh-states-vulnerabilities-serverwazuh][0][p]_bytes" : 31481960
},
"shard_paths" : {
"[.opendistro-ism-managed-index-history-2024.07.21-000314][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=mHlH1XI5S76uCbq6Qq7TZg]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.06.27-000293][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Slu2zuoLS6e5JUZBUdMSRA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.17][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=PXTCJ86lSRuslR5CPb4-1A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.25w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Uftke_boQiaEPr6EyQV9KQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.13][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=LtOrTS-FSSS4ltq7T9mQ9Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.22][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=0dytQHSYT_Spby5QBlK2Kw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.16][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=mRRtkpmUQYiBRaXtua5yzQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.21][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=L84ULWeWST6EOzNQRoPt7g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.18][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=_tkRZUAqSTyZ3kVxWT3Nkw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.13][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=iWZlhhoIT-OINnZTrw31pw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.15][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hMXw-kONQeWDhMOIAQ8fJw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.12][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=jG3CaRplQNC3RlqWoNKCBw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.29][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=YlNvHwkyTvKGFsFU-M0zwg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.07][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=7J6kaRsuQIShW3B-39HpLA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.19][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=rxXbt8twQ7Cr86tv35LZtw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opensearch-notifications-config][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=vt9OY6ynS7mD3n73phBXpQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.kibana_1][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=lUrJpUuTTKu-T3GwvasmrA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.04][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=B0wocJU5QjCBU6XVgc4IBw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.12][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=I7sqQqX2TPmunRl24isvnA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-states-vulnerabilities-serverwazuh][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=NrzeycPHTnaolmcoplALsw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.10][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=DcUfTJJrQdq5dZVeITZA0w]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.28w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=aRDJF36-TMquv30stllu5Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.15-000309][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=gfHlMt7-Q_K4iASArLvYlQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.08][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=bEDiMBnTR5iphJcTUQpP-g]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-reports-definitions][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=KSolwWRfTo6H4NKxuAxCUA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.11][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=PKgUQkesSZKvQlWxQpNSUA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.01][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=RUZYINRgSFOaDM3fzNaNZw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-config][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=UXZcXCaRRoGRNpqOqiA5EA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.23][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=JTZopXX7TrSCOMA7T2Khhw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.02][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=b9NWHTJtQaiDWoRz-C8wnA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.25][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=X5IKpN7RTPW692yA0v_UFQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.22][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=fBbn2TWvTPGICI0CLHB9uQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.30][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=lZrDlcL0QDOYSVgi_-FRWg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.13][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=RF9_FKNtT22WFqWNG1kSSQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro_security][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=UtwzXu6ERM27KFaTjMKtjw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.13][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=qS4bgb7KQqiO1VrL3mRYeQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.23][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=gfXLr8M-S7-hv3qqLOQVbw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.16][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=4cs0aduSRW-9E0teSUrP5Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.27][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Fkcz9NcvRJGGYFK6wYu88A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.18][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=d76FLMf4RoeW9VgkDTzb7Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.21][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=jWxl8lPgTZqbo8gkKmMQAQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.12-000306][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=fQu-VwB8TZyGwQwzO2Kd2A]" : "/var/lib/wazuh-indexer/nodes/0",
"[.plugins-ml-config][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ORzh2MHQRwmA_SIQdbNQtg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.05][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Gbo24mrPTgSOm2onvkofIg]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.18-000311][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=0RmfvoRDTX65kpN-Bidy6Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.14][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=dzldyTwGRLuBa437sclhlw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.06][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=aLnL0hGQRW-ke52hesFwhw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.29w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=wQXglKVaSL-TqzdiU2m_kQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.25][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=g_pEBU07QtG3JP6ZrCANCQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.08][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=3QiQu3Z3QZySKzhcV67iIQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.01][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=KLghc0G3SMi_mvXYiWuxrw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.26][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=awrW7oblT4S2s2eDTzvBqw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.06.26-000292][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=XOHhXg3gRFe8oAOcXXRdcA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.11][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hSk6Cv4qQZqyRodr5wK34g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.08][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=DFPFGxBXSqy-s4mESzfsiw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.kibana_4][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=-OmRZk7LQVeIVuH99JPf5Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.06.29-000295][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=GIAjN8vbQdaZifVgHjDfcA]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.17-000310][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=lMUKLQsFT6yJue_bfyzUdw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.26][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=s-GgJ9ENT8Kc4SgyFO6aWQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.22][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=xxAKItUpRkavvdXO85pSJQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.15][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=eXEdFclAR7WKQ4UUV1-KyQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.07][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=CScqN-e1SxedvCzTE5bpqw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.tasks][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=t7zAAHfFQB6aY38G1RiLCw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.19-000312][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=vf6_GZ_4QtmJIWtF4y7m9A]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-job-scheduler-lock][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=AGK6r8NJRGacmODNRnBsGQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.01-000296][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=nky9yFrbQ4qVjjR9GZfGsA]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.02-000297][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=S_oj7wYdTTqw44C80MNjzQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.02][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=s3CQhmvLQteVYmL1wAfUBQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.kibana_2][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=oGkbaLHwR3mwNH5IZK_lYQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.10][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=YhB_sLw4R4KqHI_3b3POLw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.12][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=be7YXfzlQD-Lhtuz2ZbnvQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.23][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=wVvXoSXKTROG9hBOUmmsYg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.13][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=g70q7RfMSd2YjCakUxsp9A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.23][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=2D5r0MRxSo6X8YfH93kucw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.09-000303][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=FN09UqVCTICavi7fkZAqEw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.14][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ZmMIUwtsTbqrQfTVwyqk0g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.17][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=93tsAMkSRVWzQOaf0u2Bew]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.21][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=mSu1vzIGTB6RsWY86eRRdg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.15][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=k9msSnbxT_GOaTlZ12UQjA]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.07-000302][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=svBVI8D_SZWMnK8-Ku7rsw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.27][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=t1Zq1aZxS06_mSlANGhxjw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.kibana_3][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=z5gJCJvlRteoaa0Yl4l7Tg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.03][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=-MrRM6irTiyUsOAWtJvq2Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.20][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=0A_Dx21nT5-VSpy4pAf15A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.16][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=jDGL5pNdSB-sbGoObLdaBg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.27w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=VeMRtfyuT1qStNyqCrpWIQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.11][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=GayDgbJdT4SVRO8zb5lt7A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.07][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=XtoqLJekQ-ubHEMo-g1maw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.04][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=a8Lz0MTtQwS7Nb59gwXBLw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.21][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=vRZgGigNSWW3TMmBWvAj5A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.01][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=tZBqcfU1R6STgy0EvqEFHw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.06.23-000291][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=5rDaXXTgRVmdfRm6CjnPAA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.19][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Oyh0UM8ASLeaA26xDeeTSA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.28w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=viTtqOxsT9KGQtrVBrjP2A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.27w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=_MkBXRXpQQS3QGB0X0D1jw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.11-000305][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=qXQo4EwSTpqiYuN4J3WeRw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.28][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=03517a6WTw2GNkjkv4hHrA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.24w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ZSr4q730RzKZl9QMBfPuiQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.23-000315][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=EX82RCYKSTy2Ib-n95cRaQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.09][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=bR1DuDbkTvKUjoTOAIosVg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.06][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=6VhP06JdSL6uqeaZFRFqAA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.26w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hOmFmTjsRSSd2esch5xQzg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.17][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=5dErwvg7S0KVep3yVefbMw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.06][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=IsumjnRJSXi40gop7TtJrQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.29][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=uRigXoNnTRmOuffM2jgtTQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.19][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=_M1ifjOfSQ6djAu-lxMpSg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.06][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=zkbudKm4QbW7uKr75puSrQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.14][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=7TRwAhR1SdaYc124-ZhvGA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.20][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=H_K8_wY3TY2FOSfddw7y2Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.06][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ajO8VxhgRN2YkIIODASAzQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-reports-instances][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=s9l-g0xMQEKHmUC-vxiLcg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.10][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=uiDfBb-PSlqZrPVgsNtsfA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.27][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=-tUMQjI4S9K5iANFjfqAog]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.12][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ACLC0z6iTMy0JvhKjGBtZA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.12][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ChM7VnKARUa1cVtLprcPQg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.08][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hXes0igQSFqLUtAmDd29Kw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.20-000313][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=8ME6CKoMRDugK3tNAI1pLw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.18][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=PlYLMhQOTgeetUA46T8ApA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.30][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=7u3T5y9TS7ysdRbkV9sHAw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.04][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=CeqT6DDtRAup3qphGQeMlQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.13-000307][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=gv19fR7PRjCQyRwtCSatRA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.20][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=L0ZNYuTaQTWUgvtzAMIG8A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.14][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=W17qSCJARl-gk8mzGqoJ-w]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.06][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Go4s_S0bS9ebYC6DEg6cTw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.07][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=U_9qGPJjRniMB-J4f9Zx3w]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.15][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hwHMpVgOScay1hAtwwUrcw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.14][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=MB-9XycPQii-SWVzZgurgQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.04][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=sxes6CIiTe2BfNHyLq_oZw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.28][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=7u3cPlefRfqWo_0xg-DwQg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.12][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=y7zQ74zwSMeOOSR8WsybTQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.10-000304][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=nxhD24bBTf2BDBWSSyFRVA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.21][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=SaufLT7wQ_-BQXrVN5EN-A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.25w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=57w3Ge_wT12UYiA-wDP-cQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.09][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=dVpdhV8iTt2TC5szfHQKHg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.05][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=8jwRFnZNTqe3pwGmgpCZpQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.10][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=XyRPaPE0SiedoBf-B8qL5Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.04][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=sjEj3TMbSb2tQvtg7DEsDw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.13][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=N6fpWUiZSGmOd0NfE2aZgw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.10][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=oNi06j9gT-yD7dEkC0PPhQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.07][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=qvawtT07QbuKXIBAWFl_kA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.08][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=3TUiuZRQSFeTW2WJ_Os-3g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.05][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=FO0bNEgfQ4yIaVC4FaeYCg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.20][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Yc20IKO3QlOp6_L0TiSVIA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.17][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Ybj9gx9JSnKwM_yLtKrePA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.14][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=PLTJrzQUSIm-jisvVHQKIA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.18][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hUgfsC8HSaGF_mzd2RbaLw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.05][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=wOHae4rnSj-MjB-ZiTpotw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.30w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=J5PWjbRZQ7-Xirelh2Ja2Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.16][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=K4Nv_ZBUSe2CNNUAxhNGKA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.17][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=RT-jXUUVTmC0do6P3BKE8A]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.16][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=OoDh8dpnTnmSzwvozwmrOg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.09][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=JT2FjQ50T4aXpw0heTBqDQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.15][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=tYDKoHQCSNiyo3imFmUNlQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.26][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Jye39l39SoWRLyle9R4KfA]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opensearch-sap-log-types-config][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=8akbagXkR6KuYuGSWK8BkQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opensearch-observability][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ovQ_zirPRJWOJz5vXTI15w]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.14-000308][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=4uGLyGWwSBmxXjyybqIG5Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.29w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=5vQGEqUsSz2atyOAEKUtrw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.07][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=uzX5HdAsTZi6Jv4OZNMdVg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-statistics-2024.26w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=0Zg8W2GpTNODtXGYlHl13w]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.24w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=OhvJJXeSQwCpaAbgOiQgog]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.22][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=XpZQBk4pRlu77jVzumOpcQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.08][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=N50DYVfHQR6DAnuD1cRCnw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.05][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=x_n97m9MR-msYGEZzhxKjA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.03][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=RN8m9VoORBCEy6eu7nfgtA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.23][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=hB9OOpdTQ_a-jOYi81R8hg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.04][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=9YpG0nRQQCeNJnHhbyuUIA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.18][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=_gnPByNLTouxRaGNr-bC0g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.09][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=NZRFGZl0TnGX1HyQxkeQPg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.25][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=DOhBYqeSQXuvUmutaQIM2g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.16][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=cETN5VOZQSWc4Xp7kKSKqQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.29][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=nwr9xzIWQkawPiTBWfUZ1Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.19][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=YWza_jXEQuStHCxyf_XJeA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-monitoring-2024.30w][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=BOZ5AkAATXKytDgPng8VVw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.20][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=KHsEl8SzQ5KQT6JNkAINNQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.03-000298][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=fM88aF-xRT6lF3G1RV3YNA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.11][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=K4LLL-nOTTCZeIXvlfohPg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.30][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=r3WeohQaTqKDXhiyZ65jmQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.11][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=o8qncA1ASLqM3A_4Z_U5cg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.05][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=lPiyGK--T9iHlPfbHWTb2w]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.11][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=HkKtm1f7QMOE2ozXwfXc2Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.23][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=CARkXtO3Qj-g-MJso_VJ4g]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.09][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=LRzdAcF7RBGScUem4_bW0w]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.06-000301][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=UQSET4hEQam27dQtRu2hug]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.22][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=wTN7q1S1TeiYIoDoMPYczA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.28][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=45sGblpRQ3qm-AI8IixlXA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.22][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Q7FMGA-cSoyZyAsOeVGWRw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.09][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=fI1Bk1Y5TX-jaEQDKOdnCw]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.05-000300][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=LKtojHR_SeajPcp3XOpbEA]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.07.04-000299][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=vv7N2f-kQp2_CqjVAfx93Q]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.20][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=DVjdKW0jRsCKRlDtBEnlvw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.18][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=ebCeXMgVSUyatVHG7aKbcw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.02][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=_gPK7W3WT3a5v_2Zb-jrEw]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.03][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=LMSYO-ohQSu04hzbAuAFdA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.19][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=m-WBXdbeTtScFbNULk4VSA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.17][2], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=b17Z1RZeSMKHf6O5gZDWIg]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.19][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=0QxDh95oRuuHzLtl3xf-wQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.07.15][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=q3nLT7pHQ2Kv3a3jktN0jA]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.21][1], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=1h3Ltd4YQZyjmGV6-jRRuQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-ism-managed-index-history-2024.06.28-000294][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=6iuHWqAyTAGj3ssoAas7WQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[wazuh-alerts-4.x-2024.06.10][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=Tpr4cRmWRx2QCnlPJjTqfg]" : "/var/lib/wazuh-indexer/nodes/0"
},
"reserved_sizes" : [
{
"node_id" : "VTV6O3A9SGKtuG_iZqxHOw",
"path" : "/var/lib/wazuh-indexer/nodes/0",
"total" : 0,
"shards" : [
"[wazuh-alerts-4.x-2024.07.23][0]",
"[.opendistro-reports-definitions][0]",
"[.opendistro-ism-managed-index-history-2024.07.21-000314][0]",
"[wazuh-alerts-4.x-2024.06.10][0]",
"[wazuh-alerts-4.x-2024.06.25][0]",
"[wazuh-alerts-4.x-2024.06.10][1]",
"[wazuh-alerts-4.x-2024.06.25][1]",
"[wazuh-alerts-4.x-2024.06.10][2]",
"[wazuh-alerts-4.x-2024.07.15][0]",
"[wazuh-alerts-4.x-2024.06.25][2]",
"[wazuh-alerts-4.x-2024.07.15][1]",
"[.kibana_1][0]",
"[wazuh-alerts-4.x-2024.07.15][2]",
"[wazuh-alerts-4.x-2024.06.04][1]",
"[wazuh-alerts-4.x-2024.06.04][0]",
"[wazuh-alerts-4.x-2024.07.08][2]",
"[wazuh-monitoring-2024.26w][0]",
"[wazuh-alerts-4.x-2024.06.04][2]",
"[wazuh-alerts-4.x-2024.07.08][1]",
"[wazuh-alerts-4.x-2024.07.08][0]",
"[wazuh-alerts-4.x-2024.07.23][1]",
"[wazuh-alerts-4.x-2024.07.23][2]",
"[.opendistro-ism-managed-index-history-2024.07.17-000310][0]",
"[.plugins-ml-config][0]",
"[wazuh-monitoring-2024.24w][0]",
"[wazuh-alerts-4.x-2024.06.21][2]",
"[wazuh-alerts-4.x-2024.06.21][1]",
"[wazuh-alerts-4.x-2024.07.03][1]",
"[wazuh-alerts-4.x-2024.07.03][2]",
"[wazuh-alerts-4.x-2024.07.03][0]",
"[wazuh-alerts-4.x-2024.06.21][0]",
"[wazuh-alerts-4.x-2024.06.08][2]",
"[wazuh-alerts-4.x-2024.06.08][1]",
"[wazuh-alerts-4.x-2024.07.04][2]",
"[.kibana_4][0]",
"[wazuh-alerts-4.x-2024.07.04][0]",
"[wazuh-alerts-4.x-2024.07.04][1]",
"[wazuh-alerts-4.x-2024.06.08][0]",
"[wazuh-alerts-4.x-2024.07.16][2]",
"[wazuh-alerts-4.x-2024.07.05][1]",
"[wazuh-alerts-4.x-2024.07.16][1]",
"[.opensearch-sap-log-types-config][0]",
"[wazuh-alerts-4.x-2024.07.05][0]",
"[wazuh-alerts-4.x-2024.07.16][0]",
"[wazuh-alerts-4.x-2024.07.02][0]",
"[wazuh-alerts-4.x-2024.07.05][2]",
"[wazuh-alerts-4.x-2024.07.02][1]",
"[wazuh-alerts-4.x-2024.07.02][2]",
"[.opendistro-ism-managed-index-history-2024.06.23-000291][0]",
"[.opendistro-ism-managed-index-history-2024.07.14-000308][0]",
"[.opendistro-ism-managed-index-history-2024.07.19-000312][0]",
"[wazuh-alerts-4.x-2024.06.12][2]",
"[wazuh-alerts-4.x-2024.06.12][1]",
"[wazuh-alerts-4.x-2024.06.12][0]",
"[wazuh-statistics-2024.24w][0]",
"[wazuh-alerts-4.x-2024.07.07][1]",
"[wazuh-alerts-4.x-2024.07.07][0]",
"[.opendistro-ism-managed-index-history-2024.07.15-000309][0]",
"[.opendistro-ism-managed-index-history-2024.06.28-000294][0]",
"[wazuh-alerts-4.x-2024.07.13][1]",
"[wazuh-alerts-4.x-2024.07.13][0]",
"[wazuh-alerts-4.x-2024.07.13][2]",
"[wazuh-alerts-4.x-2024.06.20][0]",
"[wazuh-alerts-4.x-2024.06.20][1]",
"[wazuh-alerts-4.x-2024.06.20][2]",
"[wazuh-alerts-4.x-2024.06.28][2]",
"[.opendistro-job-scheduler-lock][0]",
"[wazuh-alerts-4.x-2024.06.28][1]",
"[wazuh-alerts-4.x-2024.06.28][0]",
"[wazuh-alerts-4.x-2024.07.07][2]",
"[wazuh-alerts-4.x-2024.06.23][0]",
"[wazuh-alerts-4.x-2024.06.23][1]",
"[.opendistro-ism-managed-index-history-2024.06.29-000295][0]",
"[.opendistro-ism-managed-index-history-2024.07.03-000298][0]",
"[wazuh-alerts-4.x-2024.06.23][2]",
"[wazuh-statistics-2024.30w][0]",
"[wazuh-alerts-4.x-2024.07.21][2]",
"[wazuh-alerts-4.x-2024.07.21][1]",
"[wazuh-alerts-4.x-2024.07.21][0]",
"[wazuh-alerts-4.x-2024.07.11][2]",
"[wazuh-alerts-4.x-2024.07.11][1]",
"[wazuh-alerts-4.x-2024.07.11][0]",
"[wazuh-alerts-4.x-2024.06.11][2]",
"[wazuh-alerts-4.x-2024.06.11][1]",
"[.opendistro-ism-managed-index-history-2024.07.13-000307][0]",
"[wazuh-alerts-4.x-2024.06.16][1]",
"[wazuh-alerts-4.x-2024.06.16][0]",
"[wazuh-alerts-4.x-2024.06.11][0]",
"[.tasks][0]",
"[wazuh-statistics-2024.28w][0]",
"[wazuh-alerts-4.x-2024.07.14][0]",
"[wazuh-alerts-4.x-2024.07.14][1]",
"[wazuh-alerts-4.x-2024.07.14][2]",
"[wazuh-monitoring-2024.25w][0]",
"[wazuh-monitoring-2024.28w][0]",
"[wazuh-alerts-4.x-2024.07.01][0]",
"[wazuh-statistics-2024.26w][0]",
"[wazuh-alerts-4.x-2024.07.01][2]",
"[wazuh-alerts-4.x-2024.07.01][1]",
"[wazuh-alerts-4.x-2024.06.16][2]",
"[wazuh-alerts-4.x-2024.06.17][0]",
"[wazuh-alerts-4.x-2024.06.17][1]",
"[.opendistro-ism-managed-index-history-2024.07.10-000304][0]",
"[wazuh-alerts-4.x-2024.06.17][2]",
"[wazuh-alerts-4.x-2024.07.22][1]",
"[wazuh-alerts-4.x-2024.07.22][2]",
"[wazuh-alerts-4.x-2024.06.26][1]",
"[wazuh-alerts-4.x-2024.07.22][0]",
"[wazuh-alerts-4.x-2024.06.29][0]",
"[wazuh-alerts-4.x-2024.06.26][2]",
"[wazuh-alerts-4.x-2024.06.29][1]",
"[wazuh-alerts-4.x-2024.06.29][2]",
"[wazuh-alerts-4.x-2024.06.26][0]",
"[.opensearch-observability][0]",
"[wazuh-alerts-4.x-2024.06.07][0]",
"[wazuh-alerts-4.x-2024.06.07][1]",
"[wazuh-alerts-4.x-2024.06.07][2]",
"[wazuh-alerts-4.x-2024.06.18][0]",
"[wazuh-alerts-4.x-2024.06.18][2]",
"[wazuh-alerts-4.x-2024.06.18][1]",
"[.opendistro-ism-config][0]",
"[wazuh-alerts-4.x-2024.06.05][0]",
"[wazuh-alerts-4.x-2024.06.05][2]",
"[wazuh-alerts-4.x-2024.06.05][1]",
"[.opendistro-ism-managed-index-history-2024.07.07-000302][0]",
"[wazuh-states-vulnerabilities-serverwazuh][0]",
"[.opendistro-ism-managed-index-history-2024.07.04-000299][0]",
"[wazuh-alerts-4.x-2024.07.10][0]",
"[wazuh-alerts-4.x-2024.07.19][2]",
"[wazuh-alerts-4.x-2024.07.10][1]",
"[wazuh-alerts-4.x-2024.07.06][0]",
"[wazuh-alerts-4.x-2024.07.10][2]",
"[wazuh-alerts-4.x-2024.07.06][1]",
"[wazuh-alerts-4.x-2024.07.19][0]",
"[wazuh-alerts-4.x-2024.07.19][1]",
"[wazuh-alerts-4.x-2024.06.14][0]",
"[wazuh-alerts-4.x-2024.06.14][1]",
"[wazuh-alerts-4.x-2024.07.17][0]",
"[wazuh-alerts-4.x-2024.07.17][1]",
"[wazuh-alerts-4.x-2024.07.17][2]",
"[wazuh-alerts-4.x-2024.07.06][2]",
"[wazuh-alerts-4.x-2024.06.14][2]",
"[.opendistro-ism-managed-index-history-2024.07.12-000306][0]",
"[wazuh-monitoring-2024.30w][0]",
"[.opendistro-ism-managed-index-history-2024.07.11-000305][0]",
"[.opendistro-ism-managed-index-history-2024.07.05-000300][0]",
"[.opendistro-ism-managed-index-history-2024.07.18-000311][0]",
"[.opendistro-ism-managed-index-history-2024.06.27-000293][0]",
"[.opendistro-ism-managed-index-history-2024.07.01-000296][0]",
"[wazuh-alerts-4.x-2024.07.20][2]",
"[wazuh-statistics-2024.25w][0]",
"[wazuh-alerts-4.x-2024.07.20][1]",
"[wazuh-alerts-4.x-2024.07.20][0]",
"[wazuh-alerts-4.x-2024.06.15][1]",
"[wazuh-alerts-4.x-2024.06.30][0]",
"[wazuh-alerts-4.x-2024.06.15][0]",
"[wazuh-alerts-4.x-2024.07.18][2]",
"[wazuh-alerts-4.x-2024.07.12][2]",
"[wazuh-alerts-4.x-2024.06.30][2]",
"[wazuh-alerts-4.x-2024.07.18][1]",
"[wazuh-alerts-4.x-2024.06.15][2]",
"[wazuh-alerts-4.x-2024.06.30][1]",
"[wazuh-alerts-4.x-2024.07.18][0]",
"[wazuh-alerts-4.x-2024.07.12][0]",
"[wazuh-alerts-4.x-2024.07.12][1]",
"[.opendistro-ism-managed-index-history-2024.07.23-000315][0]",
"[.opendistro-ism-managed-index-history-2024.06.26-000292][0]",
"[wazuh-alerts-4.x-2024.06.27][2]",
"[wazuh-alerts-4.x-2024.06.27][1]",
"[wazuh-alerts-4.x-2024.07.09][1]",
"[wazuh-alerts-4.x-2024.07.09][2]",
"[.opendistro-ism-managed-index-history-2024.07.06-000301][0]",
"[.opendistro-ism-managed-index-history-2024.07.20-000313][0]",
"[wazuh-alerts-4.x-2024.06.13][2]",
"[wazuh-statistics-2024.29w][0]",
"[wazuh-alerts-4.x-2024.06.13][0]",
"[wazuh-alerts-4.x-2024.06.13][1]",
"[.opensearch-notifications-config][0]",
"[wazuh-alerts-4.x-2024.06.06][1]",
"[wazuh-alerts-4.x-2024.06.06][0]",
"[wazuh-alerts-4.x-2024.06.06][2]",
"[.kibana_3][0]",
"[.opendistro-ism-managed-index-history-2024.07.02-000297][0]",
"[wazuh-statistics-2024.27w][0]",
"[wazuh-alerts-4.x-2024.06.22][2]",
"[wazuh-alerts-4.x-2024.06.22][0]",
"[wazuh-alerts-4.x-2024.06.22][1]",
"[wazuh-alerts-4.x-2024.06.09][0]",
"[wazuh-alerts-4.x-2024.06.09][1]",
"[wazuh-alerts-4.x-2024.06.09][2]",
"[wazuh-monitoring-2024.27w][0]",
"[wazuh-monitoring-2024.29w][0]",
"[.kibana_2][0]",
"[.opendistro-ism-managed-index-history-2024.07.09-000303][0]",
"[wazuh-alerts-4.x-2024.06.19][0]",
"[wazuh-alerts-4.x-2024.06.19][1]",
"[wazuh-alerts-4.x-2024.06.19][2]",
"[.opendistro-reports-instances][0]",
"[.opendistro_security][0]",
"[wazuh-alerts-4.x-2024.07.09][0]",
"[wazuh-alerts-4.x-2024.06.27][0]"
]
}
]
},
"can_allocate" : "no",
"allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
"node_allocation_decisions" : [
{
"node_id" : "VTV6O3A9SGKtuG_iZqxHOw",
"node_name" : "node-1",
"transport_address" : "192.168.80.33:9300",
"node_attributes" : {
"shard_indexing_pressure_enabled" : "true"
},
"node_decision" : "no",
"deciders" : [
{
"decider" : "same_shard",
"decision" : "NO",
"explanation" : "a copy of this shard is already allocated to this node [[.opendistro-ism-managed-index-history-2024.07.21-000314][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=mHlH1XI5S76uCbq6Qq7TZg]]"
}
]
}
]
}
root@serverwazuh:/home/usuario# curl -k -u admin:apss -X GET "https://127.0.0.1:9200/_cluster/allocation/explain?pretty&include_disk_info=true" | grep -i "opendistro-job-scheduler"
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 "[.opendistro-job-scheduler-lock][0][p]_bytes" : 232080,
"[.opendistro-job-scheduler-lock][0], node[VTV6O3A9SGKtuG_iZqxHOw], [P], s[STARTED], a[id=AGK6r8NJRGacmODNRnBsGQ]" : "/var/lib/wazuh-indexer/nodes/0",
"[.opendistro-job-scheduler-lock][0]",

root@serverwazuh:/home/usuario# curl -k -u admin:pass -X GET "https://127.0.0.1:9200/.opendistro-job-scheduler-lock/_settings?pretty"
{
".opendistro-job-scheduler-lock" : {
"settings" : {
"index" : {
"creation_date" : "1690999674601",
"number_of_shards" : "1",
"number_of_replicas" : "1",
"uuid" : "q8wBUFDsRGGuLoFk0dk-3A",
"version" : {
"created" : "136277827",
"upgraded" : "136317827"
},
"provided_name" : ".opendistro-job-scheduler-lock"
}
}
}
}
----

----

Let me know if you need any other information. The agents were updated also to 4.8.0 after upgrade . hope this information is complete to give me a help over this issue. thanks

Regards....
Marcelo

index yelow.png

Marcelo Dimargo

unread,

Jul 26, 2024, 10:42:00 AM7/26/24

to Wazuh | Mailing List

Hi team,

Can be fixed that? let me know. Thanks

Marcelo

Marcelo Dimargo

unread,

Jul 26, 2024, 12:57:35 PM7/26/24

to Wazuh | Mailing List

After a several days an reseach I found the solution over this error. This is the fix.....

Over Dev Tools

GET _cluster/health I get status Yellow and "unassigned_shards" : 27

Whith this command you can get the indexes with problems (each one of the 27 unassigned)
GET _cat/shards?v=true&h=index,shard,prirep,state,node,unassigned.reason&s=state

The next stept is to know more about that error. On my case was "explanation" : "a copy of this shard is already allocated to this node "

GET /_cluster/allocation/explain

After get that, you can run the command below to set the shard to 1 and replicas to 0 , in the case that you have all in one instalation (one manager, one indexer.....).
On my case .opendistro-ism-managed-index-history-*** have some shards duplicated and replicas that are not needed... on my all in one instalation

PUT _index_template/managed-history
{
"index_patterns": [
".opendistro-ism-managed-index-history-*"
],
"template": {
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
}
}
}

And the same with .opendistro-ism-managed-index-history-* with replicas not needed.. The below is on the console

curl --cacert /etc/wazuh-indexer/certs/root-ca.pem --cert /etc/wazuh-indexer/certs/admin.pem --key /etc/wazuh-indexer/certs/admin-key.pem -X PUT "https://127.0.0.1:9200/.opendistro-ism-managed-index-history-*/_settings" -H 'Content-Type: application/json' -d '{
"index" : {
"number_of_replicas" : 0
}
}'

Now, all is Green with GET _cluster/health

The were all the commands:
GET _cluster/health --> to know the status
GET _cat/shards?v=true&h=index,shard,prirep,state,node,unassigned.reason&s=state --> to know witch index have errors

GET /_cluster/allocation/explain --> the error of the index
Next is to change :
PUT _index_template/managed-history
{
"index_patterns": [
".opendistro-ism-managed-index-history-*"
],
"template": {
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
}
}
}

PUT /.opendistro-ism-managed-index-history-*/_settings
{
"index" : {
"number_of_replicas" : 0
}
}

PUT /.opendistro-ism-config/_settings
{
"index" : {
"number_of_replicas" : 0
}
}

DONE, with GET _cluster/health know it is Green. If you have error over some command , check the spaces over each PUT

Regards

Marcelo

Reply all

Reply to author

Forward

0 new messages