This error message is shown when Filebeat does not push the index template to the Indexer cluster.
This could indicate that there is an issue with the connection from Filebeat to Indexer.
In case if you still get this error "
[Alerts index pattern] No template found for the selected index-pattern title [wazuh-alerts-*]"You can also manually add the index by running the following command:
curl -so template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.x.x/extensions/elasticsearch/7.x/wazuh-template.json |
curl -X PUT "https://localhost:9200/_template/wazuh" -H 'Content-Type: application/json' -d @- -u <user>:<password> -k Change this according to your Wazuh version.
v4.x.x
For example, if you have 4.9.2 replace it with this.
You can check your wazuh version by following command
/var/ossec/bin/wazuh-control infoIf that still causes an error then Please check the Filebeat and wazuh indexer service status using the command:
systemctl status wazuh-indexer?
Please share the
cat /var/log/wazuh-indexer/wazuh-cluster.log Regards,
Hasitha Upekshitha