no template found for the selected index-pattern title

[Assistenza Isoft]

Good morning, I'm configuring tests for customers where I would like to have an indexer and dashboard server on our cloud and a server manager for each client with each its own indexes. I followed the various guides but I get an error when I log in with admin in web page after creating the custom indexes: it gives me this error "[Alerts index pattern] No template found for the selected index-pattern title". I can't figure out what's missing. thanks, Stefano

[Marcos Sanchez Delgado]

Hello.

This error message is shown when Filebeat does not push the index template to the Indexer node. Could you check that Filebeat is working properly? Please run the command: filebeat test output.
I also recommend you check the documentation on this point. You should not receive this error if you have followed all the steps correctly. It is important that you insert the new template into the Wazuh indexer, using: curl -XPUT -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD> 'https://<INDEXER_IP_ADDRESS>:9200/_template/wazuh' -H 'Content-Type: application/json' -d @template.json.
Remember to restart Filebeat and the Wazuh server components.
If that still causes an error, please check the wazuh indexer service status using: systemctl status wazuh-indexer. Also, you can share the /var/log/wazuh-indexer/wazuh-cluster.log file.

I hope this will be helpful.

​

[Assistenza Isoft]

Hi Marcos,
thank you for the advice. Now works. 

Is there a possibility to create read-only users for just one specific index? 

Because I followed this guide (https://wazuh.com/blog/wazuh-multi-site-implementation/) but it doesn't seem to work correctly because I also see the rest of the indexes.
Thank you,
Stefano

[Marcos Sanchez Delgado]

Hi Stefano.

I'm glad to hear that you have solved the previous problem!

For this new query, as this is a different topic, please open a new thread so all the community users can benefit from our answers.

Thank you.

Regards.

[Assistenza Isoft]

hi Marcos,

ok thank you.

Stefano