Cleanup after index recovery

[Alessio L]

Hi all,

for reasons that I'm ashamed for, I had to restore ~1 week of indexes.
I've followed the guide and no major issue emerged.
Now that all my former lost indexes have been digested, can I delete the recovery.json file and remove the /tmp/recovery.json string from manifest.yml?

If I understood how wazuh works, I think I can safely remove everything but a confirmation from a wiser user than me would be appreciated.

Thanks in advance for the time
Alessio

[Jorge Eduardo Molas]

Hello! I hope you're doing well. Thank you for using Wazuh. Please don't be ashamed of mistakes, they help us grow!
If you have followed the re-injection process correctly as it seems, you already have the data indexed. Likewise, it also has the backups from which the JSON file was generated to be reinjected. You can delete them (since it takes up disk storage space).

Just keep in mind that the indexes that were lost and their information are available again on your dashboard and that you have the corresponding backups.

Have a nice day!
Greetings!

[Alessio L]

Thank you Jorge.

On Monday I’ll re-check everything just to be sure and proceed to cleanup.

Have a nice weekend