Assistance Required for Viewing Backup Indices and Alert Logs in Dashboard

[Chandra pal singh Chauhan]

Dear Team,

I hope you are doing well.

I have a 30-day backup of indices that I exported from the manager side. I would now like to view these indices and their logs in the dashboard.

Additionally, I also have alert log files for the same 30-day period. Could you please guide me on the best and easiest way to access and view these old indices or alert logs in the dashboard?

I would appreciate your support on this.

Thank you.

Best regards,

Chandra

[Victor Carlos Erenu]

Hello

To help you with this, I need to know a little more about your deployment:

• What version of Wazuh are you using?
• What type of deployment have you performed? (single or multi node server installation, Docker, Kubernetes)
• What type of backup have you performed? (snapshot, JSON export, alerts.log backup, etc.)

[Chandra pal singh Chauhan]

Hello Victor

Currently, I am using version 4.14.3 with a single-node server installation. I have identified several indices located in the /var/lib/wazuh-indexer/nodes/0/indices/ path (screenshot attached for reference). These indices were previously exported from the manager side.

I would now like to import these old indices and visualize them in the dashboard. Since these are historical data, I would appreciate your guidance on the correct and most efficient way to proceed with importing and viewing them.

Thank you for your support.

Regards,

Chandra

[Victor Carlos Erenu]

Hi Chandra

Could you explain in more detail what you mean by "exporting indexes from the manager side"?

[Chandra pal singh Chauhan]

Hello Victor

I moved those indices to an S3 bucket, and now I want to copy them to the server and view their contents.

Regards,

Chandra