We need to install wazuh 4.7

[ismailctest C]

Hi Team,

Please share the distributed installation link for wazuh indexer.

We are planning to install 2 wazuh manager servers and 3 indexer servers (3 nodes)

Servers Plan:

Waz Manager Server 1

Waz Manager  Server 2

Indexer Server 1

Indexer Server 2

Indexer Server 3

[Diego Gustavo Oliva]

Hello,

Please find the Wazuh Indexer installation guide:
https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html

For Wazuh Manager:
https://documentation.wazuh.com/current/installation-guide/wazuh-server/index.html

And finally, you will install the Wazuh Dashboard that can be placed in the Indexer Server 1:

https://documentation.wazuh.com/current/installation-guide/wazuh-dashboard/index.html

Feel free to ping us again if you need any additional information.

Regards,
[Wazuh] Diego.-

[ismailctest C]

Hi Diego Gustavo Oliva,

We have installed wazuh indexer, manager and dashboard as per the document and working fine,  thanks for your support.

Servers Details:

Waz Manager Server 1 - Master

Waz Manager  Server 2 - Worker

Indexer Server 1 - Master

Indexer Server 2 - Worker

Indexer Server 3 - Worker

Note: Filebeat ingesting the logs only to the indexer server1 server.

One more support needed:

Point 1: we need to keep the data as mentioned below

Indexer Server 1 - Hot data (Period: After 15 days)

Indexer Server 2 - Warm data     ( Period: After 30 days)

Indexer Server 3 - Cold data      ( Period: After 60 days)

Point2: All data replicas should be zero

Point3: Please let us know how to configure ILM policy to achieve this, please share step by step doc.

Point4: What configuration (node.roles) needs to be applied in opensearch.yml to achieve this?

Thanks

[John Soliani]

Hello Ismailctest

  Please, for topics unrelated to the post, open a new thread so all the members of the community can benefit from the answer, please.

Regards,
John.-