Issue with Exporting Reports for 30/60 Days Data

[Chandra pal singh Chauhan]

Hello Team,

I hope you are doing well.

I am currently experiencing an issue when loading and exporting reports for the past 30 or 60 days of data. During the export process, I receive an internal error (Error Code 500), and an error message appears in the visualization matrix (graph).

Could you please help me understand the cause of this issue and guide me on how to resolve it?

Thank you for your support.

Regards,

Chandra

[Bony V John]

Hi,

The 500 internal error during report export usually happens when the selected time range is too large for the Wazuh Dashboard reporting process to render.

For 30 or 60 days of data, the visualization may need to process a large number of alerts, aggregations, and graph buckets. This can cause timeout and memory pressure, especially if the dashboard contains heavy visualizations.

You can try the below checks:

Try to generate the report again with a smaller time range, for example 1 or 2 days. If it works fine, it confirms that the issue is related to the report size and query load.

When you try to generate a report with a large time range, the dashboard queries the indexer. This can cause the Wazuh indexer to take too long to process the request or run out of memory due to large queries.

While generating a report with a large time range, check the resource usage of both the Wazuh indexer and dashboard:

CPU usage: top

Memory usage: free -h

Disk usage: df -h

Large queries can create a resource bottleneck on the indexer service and affect its performance.

Also, check whether there are any error logs in the Wazuh dashboard:

journalctl -u wazuh-dashboard -f | grep -iE "error|warn|fatal|critical"

Run the above command on the dashboard node, then try to generate the report again and check whether any error or warning logs appear.

Check the Wazuh indexer logs for errors or memory related issues:

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -iE "error|warn"

Try exporting the report in smaller date ranges, for example weekly instead of 30 or 60 days.

If the issue happens only for 30 or 60 days, the best fix is to reduce the report scope, split the reports by week or month, optimize the visualizations, or increase the dashboard and indexer resources.

Otherwise, please share the full output of the above commands with us for further analysis.

[Chandra pal singh Chauhan]

Hello Bony

'I have shared the required detail for your reference please check and guide me.

Regards,

Chandra

[Bony V John]

Hi,

From the shared screenshot, it seems that the indexer server has low memory. Also, the Wazuh dashboard logs show a circuit breaker exception, which usually occurs when the indexer does not have enough memory to process the request.

This is happening because you are trying to generate a report for the last 30 or 60 days of alerts. This time range may include a large amount of data. When the Wazuh dashboard queries the indexer for such a large date range, the indexer may fail to fetch all the data due to memory limitations. This can cause the report generation to fail and may also affect the indexer performance or make the indexer temporarily inaccessible.

The dashboard logs show the following error, which points to a memory issue:

May 07 10:21:51 ip-10-170-1-216 opensearch-dashboards[2921101]: {"type":"log","@timestamp":"2026-05-07T04:51:51Z","tags":["error","plugins","wazuh","POST /reports/modules/general","report-printer"],"pid":2921101,"message":"search_phase_execution_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [<reused_arrays>] would be [2047060976/1.9gb], which is larger than the limit of [2040109465/1.8gb], real usage: [2047056824/1.9gb], new bytes

To resolve this issue, we need to ensure that the JVM heap size is adequate to handle the data.  

In such a case, you need to increase the JVM heap limits in your indexer nodes. Keep in mind these restrictions:

• Use no more than 50% of available RAM.
• Use no more than 32 GB.

First, let’s check the memory of your indexer nodes:

free -h

Then, edit the /etc/wazuh-indexer/jvm.options file and change the JVM flags.

For example, if your server has 8GB of RAM, you can set the limits to 6GB as shown below:

-Xms4g
-Xmx4g

Once the heap limit is updated, you need to restart the Wazuh Indexer to apply the changes:  

systemctl daemon-reload
systemctl restart wazuh-indexer
systemctl restart wazuh-dashboard

After applying the JVM heap change, try to generate the report again.

If it is still failing, I recommend increasing the resources of the Wazuh server or generating the report in smaller date ranges, such as weekly reports instead of 30 or 60 days.

[Chandra pal singh Chauhan]

Hello

Thank for guidance now i have increase the heap size 2GB to 4GB and now i am able to export 30 day of report.