error indexer

[Tengku Arya Saputra]

Hi team,

I'm having an issue with my dashboard. All of my dashboard overviews in Wazuh are experiencing an indexser issue because they have changed to .keyword, src_ip.keyword.

This is impacting other dashboards.

I will provide one example of the error in the attached file.

Regards

[hasitha.u...@wazuh.com]

Hi Tengku

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

Hi Tengku

Please check the template as it exists in the Wazuh indexer cluster state by using the following API call against Wazuh Indexer.  It should resemble what you have in the wazuh-template.json file.

GET /_template/wazuh

Does it includes sections like these?

1. "settings": {
2.       "index": {
3.         "mapping": {
4.           "total_fields": {
5.             "limit": "10000"
6.           }
7.         },
8.  
9.         "manager": {
10.           "properties": {
11.             "name": {
12.               "type": "keyword"
13.             }
14.           }
15.         },

If you don't see sections like this with "10000" and "keyword" in them then it appears either your wazuh-template.json file is not being pushed to the indexer or you have some other template that is overriding the wazuh template.

Also, what is the output of this Wazuh indexer API call?
GET /_cat/templates?v

Additionally, Please run the following command at Indexer Management > Dev Tools :

GET /wazuh-alerts-<affectedindicedate>/_mapping/field/manager.name

The output should be:

1. {
2.   "wazuh-alerts-4.x-2025.10.31": {
3.     "mappings": {
4.       "manager.name": {
5.         "full_name": "manager.name",
6.         "mapping": {
7.           "name": {
8.             "type": "keyword"
9.           }
10.         }
11.       }
12.     }
13.   }
14. }

If that shows "type": "text", then the template fix hasn’t affected this index yet;  you’ll need to reindex.
Run the following API command in the Dev tool console to get the names of all available indices:
GET _cat/indices

Take a backup of the index for that run the following command, replacing wazuh-alerts-4.x-2023.04.24 with index name that you want to reindex:

1. POST _reindex
2. {
3.  "source": {
4.   "index": "wazuh-alerts-4.x-2025.10.31"
5.  },
6.  "dest": {
7.   "index": "wazuh-alerts-4.x-backup"
8.  }
9. }

Delete the original index:
DELETE /wazuh-alerts-4.x-2025.10.31

Reindex from backup:

1. POST _reindex
2. {
3.  "source": {
4.   "index": "wazuh-alerts-4.x-backup"
5.  },
6.  "dest": {
7.   "index": "wazuh-alerts-4.x-2025.10.31"
8.  }
9. }

Delete the backup index:
DELETE /wazuh-alerts-4.x-backup

Repeat these steps for any other indices that are showing field conflict issues.
You can also refer to the Wazuh reindexing

Let me know the update on this to check further.