Wazuh Dashboard – ResponseError / OpenSearch 503 issue
john
Hello Support Team,
We are experiencing an issue with the Wazuh Dashboard service.
Service status:
systemctl status wazuh-dashboardThe service is running, but the dashboard logs continuously show:
[ResponseError]: Response ErrorObservations:
OpenSearch is listening on 127.0.0.1:9200
HTTPS connection succeeds, but all requests return:
_cluster/health also returns 503
The OpenSearch process (Java) is running, but the cluster does not become available
The system does not have an opensearch.service; it appears to be using the Wazuh indexer service
Impact:
Wazuh Dashboard cannot connect to OpenSearch
Dashboard UI is unavailable / not functional
root@wazuh:~# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-12-17 09:13:29 MSK; 13min ago
Main PID: 1031243 (node)
Tasks: 11 (limit: 38367)
Memory: 178.3M (peak: 300.9M swap: 11.9M swap peak: 11.9M)
CPU: 13.253s
CGroup: /system.slice/wazuh-dashboard.service
└─1031243 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Dec 17 09:26:42 wazuh.domain.com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:42Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:45 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:45Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:47 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:47Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:50 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:50Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:52 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:52Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:55 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:55Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:26:57 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:26:57Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:27:00 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:27:00Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:27:02 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:27:02Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 09:27:05 wazuh.
domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T06:27:05Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Let us know if additional logs or configuration files are required.
Additionally could you instruct how to change wazuh certificates?
Best regards,
John
Stuti Gupta
Could you please clarify what you mean by "Dashboard UI is unavailable/not functional "? Is there a "wazuh dashboard not ready yet" error?
Why do you need to change the certificates? Have you got this error after changing the certificate, or are you seeing any certificate-related issue?
in case you are getting " wazuh dashboard not ready yet " error
Usually means that the Wazuh indexer service is not working properly or there is a connection issue.
We need to perform some checks to narrow down the problem:
Verify Wazuh indexer status:
systemctl status wazuh-indexer
If the status is active, check the health of your Wazuh indexer cluster:
curl -k -u admin:<password> -X GET https://localhost:9200/_cluster/health?pretty
Check the dashboard logs:
journalctl -u wazuh-dashboard | grep -iE "error|warn"
Also check and share the Wazuh indexer logs:
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -iE "error|warn"
john
Certificates just need to be changed for security reasons, not related to this issue. and yes, I am seeing this issue on Dashboard "wazuh dashboard not ready yet"
root@wazuh:~# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-12-17 09:15:24 MSK; 2h 58min ago
Docs: https://documentation.wazuh.com
Main PID: 1030955 (java)
Tasks: 136 (limit: 38367)
Memory: 14.1G (peak: 27.3G swap: 36.6M swap peak: 45.2M)
CPU: 20min 32.101s
CGroup: /system.slice/wazuh-indexer.service
└─1030955 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true >
Dec 17 09:12:43 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.3.j>Dec 17 09:12:43 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Dec 17 09:12:43 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: System::setSecurityManager will be removed in a future release
Dec 17 09:12:46 wazuh. domain .com systemd-entrypoint[1030955]: Dec 17, 2025 9:12:46 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Dec 17 09:12:46 wazuh.domain.com systemd-entrypoint[1030955]: WARNING: COMPAT locale provider will be removed in a future release
Dec 17 09:12:49 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: A terminally deprecated method in java.lang.System has been called
Dec 17 09:12:49 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.3.jar)Dec 17 09:12:49 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Dec 17 09:12:49 wazuh. domain .com systemd-entrypoint[1030955]: WARNING: System::setSecurityManager will be removed in a future release
Dec 17 09:15:24 wazuh. domain .com systemd[1]: Started wazuh-indexer.service - wazuh-indexer.
root@wazuh:~# journalctl -u wazuh-dashboard | grep -iE "error|warn" | tail
Dec 17 12:13:58 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:13:58Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:00 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:00Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:03 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:03Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:05 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:05Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:08 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:08Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:10 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:10Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:13 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:13Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:15 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:15Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:18 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:18Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
Dec 17 12:14:20 wazuh. domain .com opensearch-dashboards[1031243]: {"type":"log","@timestamp":"2025-12-17T09:14:20Z","tags":["error","opensearch","data"],"pid":1031243,"message":"[ResponseError]: Response Error"}
root@wazuh:~# cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -iE "error|warn" | tail -n100
[2024-12-07T03:08:11,877][WARN ][o.o.s.h.HTTPBasicAuthenticator] [node-1] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'
[2024-12-07T03:46:58,379][ERROR][o.o.a.a.AlertIndices ] [node-1] info deleteOldIndices
[2024-12-07T03:46:58,380][ERROR][o.o.a.a.AlertIndices ] [node-1] info deleteOldIndices
[2024-12-07T08:33:06,929][INFO ][o.o.n.Node ] [node-1] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.security.manager=allow, -Djava.locale.providers=SPI,COMPAT, -Xms1024m, -Xmx1024m, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/var/log/wazuh-indexer/tmp, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.security.manager=allow, -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=536870912, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=deb, -Dopensearch.bundled_jdk=true]
[2024-12-07T08:33:37,846][WARN ][o.o.s.c.Salt ] [node-1] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes
[2024-12-07T08:33:38,034][ERROR][o.o.s.a.s.SinkProvider ] [node-1] Default endpoint could not be created, auditlog will not work properly.
[2024-12-07T08:33:38,035][WARN ][o.o.s.a.r.AuditMessageRouter] [node-1] No default storage available, audit log may not work properly. Please check configuration.
[2024-12-07T08:33:40,210][WARN ][o.o.s.p.SQLPlugin ] [node-1] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
[2024-12-07T08:33:42,372][WARN ][o.o.g.DanglingIndicesState] [node-1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2024-12-07T08:33:44,241][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [node-1] Config override setting update called with empty string. Ignoring.
[2024-12-07T08:33:44,453][WARN ][o.o.o.i.ObservabilityIndex] [node-1] message: index [.opensearch-observability/lZ6YXhLTSfmQp4ZDYGgFlQ] already exists
[2024-12-07T08:33:44,482][WARN ][o.o.s.SecurityAnalyticsPlugin] [node-1] Failed to initialize LogType config i
Also here 's the response for this command
root@wazuh:~# curl -k -u admin:<password> -X GET https://localhost:9200/_cluster/health?pretty
OpenSearch Security not initialized.
John