multiple wazuh manager to one indexer

Marco Siekmann

unread,

Aug 15, 2023, 10:46:46 AM8/15/23

to Wazuh mailing list

Hello,

we are investigating a different setup approch, to seperate the manager, indexer and dashboards.

We want to establish wazuh in vlans but would like to consum this on a central dashboard.

so would it be possible to setup multiple manager that write their data to the same indexer?

so a master would be like 10.0.100.1

The worker would be like 10.0.101.1, 10.0.102.1, ect.

the Indexer would include all the worker nodes now and the agent needs to connect to the worker node as their target.

Does anyone have tested such a scenario and would that work?

The Dashboard would be on 10.0.100.1 as well as the central system.

kind regards

Marco

Maximiliano Ibarra

unread,

Aug 15, 2023, 12:26:58 PM8/15/23

to Wazuh mailing list

Hi Marco.
Yes, it is possible to set up multiple Wazuh managers that write their data to the same indexer. The indexer would include all the worker nodes, and the Wazuh agents would connect to the worker nodes as their targets. This setup allows you to establish Wazuh in VLANs while still being able to consume the data on a central dashboard. The central system and the dashboard can also be hosted on the same IP address.
Here are some links that may be useful in this regard:

I hope I have answered your concern. If you have any further questions or need assistance with this setup, please let us know.
Kind regards.

Marco Siekmann

unread,

Aug 16, 2023, 2:30:58 AM8/16/23

to Wazuh mailing list

Hi Maximiliano,

thanks for the confirmation.

I guess, I have a lot to do now in preparing the setup and test it.

kind regards

Marco

Reply all

Reply to author

Forward