Issue with Wazuh Dashboard - "Could not retrieve templates from indexer"

[siem wazuh]

Hello everyone,

I am facing an issue with my Wazuh Dashboard where I get the error:

🚨 [Alerts index pattern] 4002 - Could not retrieve templates from indexer due to Response Error

The Wazuh API connection and version checks seem fine, but the "Check alerts index pattern" step fails. The monitoring and statistics index patterns appear to be working properly.

Additionally, when checking the logs, I see multiple repeated opensearch data errors. The OpenSearch cluster health check returns "green" status, and the indexer is responding to API requests, but it seems that the dashboard is unable to retrieve index templates.

I have tried the following troubleshooting steps:

• Restarting the Wazuh Dashboard service.
• Running securityadmin.sh to reset security settings.
• Checking the connection to OpenSearch (curl -k -u admin ...).
• Verifying SSL certificates (openssl s_client -connect ...).
• Ensuring that Wazuh Manager, Filebeat, and OpenSearch versions are compatible.

Despite these efforts, the error persists. Has anyone encountered a similar issue or have any suggestions for resolving this problem?

Thanks in advance for your help!

[Damian Nicastro]

Hello siem wazuh

I hope you are fine.

It seems that the wazuh template was not properly loaded. Please, try reloading it from filebeat and also restart the service:

# filebeat setup --index-management

# systemctl restart filebeat

If this does not work, please send the complete logs of the wazuh-dahsboard:

# journalctl -u wazuh-dashboard --no-pager | grep -iE 'WARN|ERROR'

And the wazuh-indexer logs:

# less /var/log/wazuh-indexer/wazuh-cluster.log  | grep -iE 'WARN|ERROR'

Thanks

[siem wazuh]

Subject: Issue Resolved – Wazuh Panel Authentication

Hello everyone,

I wanted to update you that the issue has been successfully resolved. After troubleshooting, I found that the problem was caused by an outdated password for the kibanaserver user in the Wazuh panel keystore. Although I had previously updated all credentials, this particular change had not been applied.

To fix it, I updated the kibanaserver password in the Wazuh panel keystore, and after testing everything, the system is now working properly without any errors.

Thanks to everyone who contributed with suggestions. I appreciate the support

[Damian Nicastro]

Hi siem Wazuh:

I am glad you could solve the issue.

Thanks for reporting it.