Dashboard Node Error - "Internal Server Error"

[Sam Heuchert]

Can someone please help me with the below error I am receiving on my dashboard node?  I am running a distributed deployment.

Version: 2.6.0
Build: 45001
Error: Internal Server Error
    at Fetch._callee3$ (https://192.168.0.41/45001/bundles/core/core.entry.js:15:584549)
    at tryCatch (https://192.168.0.41/45001/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:760622)
    at Generator.invoke [as _invoke] (https://192.168.0.41/45001/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:764638)
    at Generator.next (https://192.168.0.41/45001/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:761817)
    at fetch_asyncGeneratorStep (https://192.168.0.41/45001/bundles/core/core.entry.js:15:577641)
    at _next (https://192.168.0.41/45001/bundles/core/core.entry.js:15:577957)

[Md. Nazmur Sakib]

Hi Sam Heuchert,

Hope you are doing well. Thank you for using Wazuh.

Are you also seeing this warning?

null_pointer_exception Cannot invoke "org.opensearch.search.aggregations.InternalAggregations.getSerializedSize()" because "reducePhase.aggregations" is null 

Please share the following details so we can know the root cause of this issue:

1. Wazuh manager to check if the service is active: systemctl status wazuh-manager

If the Wazuh API is running, try to fetch data using the CLI from the Wazuh dashboard server

curl -k -X GET "https://<api_url>:55000/" -H "Authorization: Bearer $(curl -u <api_user>:<api_password> -k -X POST 'https://<api_url>:55000/security/user/authenticate?raw=true')"

2. To ensure that Filebeat is correctly configured, run the following command: filebeat test output

3.  Please run this to check your Indexer cluster health: curl  -XGET -k -u admin:admin "https://indexer-ip:9200/_cluster/health"

4. Please run the following command to know the disk space used by shards and indices: curl -XGET -k -u admin:admin "https://indexer-ip:9200/_cat/allocation?v"

Please share the disk space details using the command df -h and free -h for memory.

Please paste the output of these commands and also share detailed wazuh-indexer logs For that, you can use the command:  cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

5. Please share the dashboard logs using command journalctl -u wazuh-dashboard or cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -i -E "error|warn"

Looking forward to your response. 

Regards

Md. Nazmur Sakib