alert index pattern timeout exceeded

[Vilaysack Vorachack]

Hi there,

I have a question about what is happening here during the health check process. I found that my Alerts index pattern has a problem here as the picture shown below

Best Regards,

[Eduardo Leon Aldazoro]

Hi, Thanks for using Wazuh and sorry for the late response!

It looks like the interface is getting a timeout while executing this check: https://github.com/wazuh/wazuh-kibana-app/blob/master/public/components/health-check/services/check-index-pattern/check-template.service.ts#L27.
Probably there is performance/configuration issue in your indexer (wazuh-indexer, elasticsearch or opensearch).

How many fields do you have for the wazuh-alerts index pattern?

Also, Is this a fresh installation or Wazuh was working properly before this error?

Please tell me. What version of Wazuh are you running?

I'll wait for your response.

[Vilaysack Vorachack]

Hi Eduardo,

I'm using the default setting that comes with wazuh docker version and has been running for about 2-3 days since I first deployed. On the first day it deployed,  everything works fine, and appeared this issue yesterday. 

However, there are some interesting things happening here. Every time I stop the docker-compose and run it again it works fine. In addition, regarding the number of field you requested I'm not pretty sure whether I attach the right one or not here because I'm very new to this technology and if it's not, please let me know.

Best Regards,

[Eduardo Leon Aldazoro]

Hi there,

Thanks for the response! 

I can tell you were able to enter the dashboard.

Did the problem get fixed by itself after the rebuild?

If the problem persists or appears again you can check the index pattern.

In the dashboard, go to Menu > Management > Stack management > Index pattern > wazuh-alerts-*. 

How many fields do you have? Do you know if there is any warning?

Please remember that you can find information about Wazuh and its component in our documentation.

Hope it helps.

Regards.

[Vilaysack Vorachack]

Hi eduardo,
The problem get fixed by itself after the rebuild.

there are 440 fields I have and there is no any warnings there.

Best regards,

[Eduardo Leon Aldazoro]

Hi,

Ok, then the problem getting fixed on rebuild confirms it was a connectivity issue at the moment of the health check on the elastic search indexer, nothing to be concerned about. 

In case there is an actual issue with the index pattern you will find the warning in the route I mentioned before.

Hope that helps.

Best Regards.