Failed to start wazuh-indexer

[fkfmilrp]

the dashboard and wazuh manager is up and running but when i restart wazuh-indexer it says
"Job for wazuh-indexer.service failed because the control process exited with error code. See "systemctl status wazuh-indexer.service" and "journalctl -xe" for details."

i have attached the following screenshots to check

-journalctl

-filebeat output

-wazuh-cluster.log

[Ujunwa Okonkwo]

Hello,

The error messages suggest a communication issue between Filebeat and the Wazuh Indexer, or there might be a problem with the Wazuh Indexer itself.  

Ensure that Filebeat is correctly configured to send logs to the Wazuh Indexer. The configuration file for Filebeat is typically located in /etc/filebeat/filebeat.yml:

  nano /etc/filebeat/filebeat.yml

Verify the correct IP address and port for the Wazuh Indexer are configured under the output.elasticsearch section.

output.elasticsearch:
  hosts: ["http://<wazuh-indexer-ip>:9200"]

Ensure that the Wazuh Indexer is reachable from the server running Filebeat. You can test it with curl:

curl http://<wazuh-indexer-ip>:9200

Ensure that there are no firewalls or security groups blocking communication between Filebeat and the Wazuh Indexer.  

Ensure that the Wazuh Indexer is correctly configured and running. Verify that the network settings (e.g., host, port) are correct.

Most times, the issue has to do with permissions.  Ensure that the necessary files exist and have the correct permissions. For example, if the error message suggests that a file is missing, check its existence and ensure Filebeat or Wazuh has the right permissions to read it. use the following to put the necessary permissions:
chown 
chmod 644 

Another common issue might be storage, verify you have enough storage space for Wazuh indexer to work properly.

You can also check the health of the Wazuh Indexer cluster:  

curl -X GET "localhost:9200/_cluster/health?pretty"

Remember to restart the Wazuh indexer service after making any changes to effect the changes.

I hope this is useful for you.

Regards,