Wazuh Vulenrability Detection Error on the Events page of the dashboard

[Aleksandar Gavric]

Hi Everyone i recently tested and upgraded wazuh to version 4.14 and ever since then when i got to Vulnerability Detection > Events i have a TypeError: Cannot read properties of undefined (reading 'toLowerCase') and am just wondering if anyone else experienced a similar error

screenshot below:

[Bony V John]

Hi,

Apologies for the late response. It looks like we missed this thread earlier. Are you still facing this issue?

Could you please share the following details so we can assist further?

• The Wazuh version you upgraded from.

• Your deployment type and the number of nodes

From the screenshot, it appears that the Wazuh Dashboard was unable to load data from the wazuh-alerts index. Are you experiencing this problem only in the Vulnerability Detection > Events section, or does it also occur in Threat Hunting or Discover?

Since the Events view uses data from the wazuh-alerts index, if the index were the issue, it would typically affect the Threat Hunting and Discover pages as well.

To investigate further, please share the dashboard and indexer logs:

On the Wazuh Dashboard server, run the below command:  

sudo journalctl -u wazuh-dashboard.service > dashboard.log

From the Wazuh Indexer server share its log file located at: /var/log/wazuh-indexer/wazuh-cluster.log

[DSI SIXAXE]

Hi,

I'm following up on this post, as we're experiencing the exact same problem. 

We can create a new post if needed.

We have three sites: one with an indexer on each site, and the main site with the dashboard.

Each site has an index pattern. 

For one site, we're getting this message in the "Vulnerability Detection" events. This doesn't occur in "Threat Hunting."

We've identified the log line: Dec. 09 10:30:54 SERVER1 opensearch-dashboards[337727]: {"type":"log","@timestamp":"2025-12-09T09:30:54Z","tags":["error","plugins","wazuh","POST /utils/logs/ui","ui"],"pid":337727,"message":"\n in G\n in div\n in s\n in div\n in EuiFlexGroup\n in div\n in Unknown\n in div\n in div\n in s\n in div\n in EuiFlexGroup\n in div\n in Unknown\n in div\n in Unknown\n in bJ\n in div\n in Unknown\n in div\n in Unknown\n in YJ\n in IntlProvider\n in withErrorBoundary(WazuhDiscoverComponent)\n in error_boundary_ErrorBoundary\n in Unknown\n in component\n in div\n in MainModuleOverview\n in Connect(MainModuleOverview)\n in withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(MainModule))))))\n in error_boundary_ErrorBoundary\n in Unknown\n in Unknown\n in Unknown\n in t\n in t\n in t\n in Application\n in Provider\n in Ie\n in IntlProvider\n in Be: can't access property \"toLowerCase\" of undefined"} 

This follows the deletion and creation of the patern index.

We had identified a format problem in the paternal index which was not good (such as string instead of a date format). 

We're having trouble identifying and resolving the root cause of the problem.

Can you help us? Thank you for your help.

PS: Translated from French to English using Google Translate

[DSI SIXAXE]

Hi,
I'm following up on this post, as we're experiencing the exact same problem.

We can create a new post if needed.

We have three sites: one with an indexer on each site, and the main site with the dashboard.

Each site has an indexing pattern.

For one site, we're getting this message in the "Vulnerability Detection" events. This doesn't occur in "Threat Hunting."

We've identified the log line:
Dec. 09 10:30:54 SERVER1 opensearch-dashboards[337727]: {"type":"log","@timestamp":"2025-12-09T09:30:54Z","tags":["error","plugins","wazuh","POST /utils/logs/ui","ui"],"pid":337727,"message":"\n in G\n in div\n in s\n in div\n in EuiFlexGroup\n in div\n in Unknown\n in div\n in div\n in s\n in div\n in EuiFlexGroup\n in div\n in Unknown\n in div\n in Unknown\n in bJ\n in div\n in Unknown\n in div\n in Unknown\n in YJ\n in IntlProvider\n in withErrorBoundary(WazuhDiscoverComponent)\n in error_boundary_ErrorBoundary\n in Unknown\n in component\n in div\n in MainModuleOverview\n in Connect(MainModuleOverview)\n in withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(withErrorBoundary(MainModule))))))\n in error_boundary_ErrorBoundary\n in Unknown\n in Unknown\n in Unknown\n in t\n in t\n in t\n in Application\n in Provider\n in Ie\n in IntlProvider\n in Be: can't access property \"toLowerCase\" of undefined"}

This follows the deletion and creation of the patern index. We had identified a format problem in the paternal index which was not good (such as string instead of a date format). We're having trouble identifying and resolving the root cause of the problem. Can you help us?

Thank you for your help.

PS : Translated from French to English using Google Translate

Le mercredi 5 novembre 2025 à 12:32:04 UTC+1, Bony V John a écrit :

[DSI SIXAXE]

Hello, 

We apologize for the previous duplicate post.

It seems we've found a solution. 

Our indexes are grouped on a template to change the string format to keyword.

When recreating the index:

 We deleted the faulty index. 

We added the newly created index. 

We reindexed all the index files by creating new ones and adding a "fixed" suffix. 

We deleted the old indexes. 

Please wait for the error message issue to resolve itself.

[SJ TEO]

I am getting this error too but it is in the MS Graph API Events page.  Please advise.