How to Migrate Wazuh, Filebeat, Elastic, and Kibana to new server

[Emil David]

Hi Team,

We have installed and configured 'Wazuh with Elastic Stack Distributed deployment' - single node cluster.

Added about 60 Linux and Windows agents, O365, Azure AD, AWS services and firewall etc...

We need to migrate wazuh manager, filebeat, Kibana & elastic, Agents, and all configuration files to the new server.
Also, let us know how to do Agent key migration...

Please help and share step-by-step docs to do this activity.

Current Versions:
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.5 LTS
Release:        18.04
Codename:       bionic

Wazuhmanager: VERSION="v4.0.4"
Filebeat,Kibana,elastic: 7.9.3

Planning to migrate this version:
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

Wazuhmanager: VERSION="4.3.11-1"
Filebeat,Kibana,elastic: 7.17.6

[Carlos Vendrell]

Hello David,

Thanks for your questions,

To migrate your information, please, follow the instructions listed in our Migration guide:

• Wazuh - Migration guide

Now, in order to migrate your agent Keys, you should copy the client.keys file from the previous cluster to the new one. 

These are the steps:

• Stop the Wazuh Manager on all the nodes on the destination cluster:

systemctl stop wazuh-manager

• Copy the file from the old cluster to the new one (all the nodes if applicable):

scp /var/ossec/etc/client.keys user@<TARGET-IP>:/var/ossec/etc/

• On the destination cluster, make sure the file has the right permissions and ownership:

-rw-r----- 1 root wazuh 410 Oct  8 18:43 /var/ossec/etc/client.keys

* Notice: If you are using a version prior to 4.3 the ownership should be root:ossec

• Start the services again on all the nodes of the destination cluster:

systemctl start wazuh-manager

Agent documentation:

• Wazuh - Agent enrollment

Hope it helps,
Carlos