Dashboard response error

[WiFi]

Hello!
I have a distributed installation: indexer,server,dashboard 4.14.1

I had a problem, ran out of space on the indexer and I decided to delete the indexes via ssh in linux at /var/lib/wazuh-indexer, as I could not enter the dashboard.
After hard deleting the indexes, I got an error in wazuh dashboard: Wazuh dashboard server is not ready yet
Also when running the command systemctl status wazuh-dashboard I get errors
opensearch-dashboards[1141]: {"type":"log","@timestamp":"2026-01-12T14:09:55Z","tags":["error","opensearch","data"],"pid":1141,"message":"[ResponseError]: Response Error"}


When running root@indexer:/# curl -k -u admin:pass -X GET "https://localhost:9200/_cat/indices?v&s=index"
I get:
curl: (7) Failed to connect to localhost port 9200 after 0 ms: Couldn't connect to server

 I also tried:
root@indexer:/# export OPENSEARCH_JAVA_HOME=/usr/share/wazuh-indexer/jdk
root@indexer:/# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/jdk
root@indexer:/# bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
-cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ \
-icl \
-nhnv \
-cacert /etc/wazuh-indexer/certs/root-ca.pem \
-cert /etc/wazuh-indexer/certs/admin.pem \
-key /etc/wazuh-indexer/certs/admin-key.pem
Security Admin v7
Will connect to localhost:9200
ERR: Seems there is no OpenSearch running on localhost:9200 - Will exit

If i try:
/usr/share/wazuh-indexer/bin/indexer-security-init.sh --options --accept-red-cluster
I get:
Security Admin v7
Will connect to 10.0.220.33:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.3
Contacting opensearch cluster 'opensearch' ...
Clustername: wazuh-indexer-cluster
Clusterstate: RED
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
ERR: .opendistro_security index state is RED.
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   FAIL: Configuration for 'config' failed because of java.net.SocketTimeoutException: 30,000 milliseconds timeout on connection http-outgoing-6 [ACTIVE]
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml

[fabio.c...@wazuh.com]

Hello!

Thanks for the detailed explanation.

Manually deleting data under /var/lib/wazuh-indexer can leave the cluster in an inconsistent state, especially if this was done while the indexer service was running.

To better understand the current situation, could you please share the following information from the indexer node?

1. Indexer service status

systemctl status wazuh-indexer

If it’s not running, please also share:

journalctl -u wazuh-indexer

2. Verify whether OpenSearch is listening on 9200

ss -lntp | grep 9200

3. Basic cluster connectivity

curl -k -u admin:<password> https://localhost:9200/_cat/nodes?v

4. Disk availability

df -h

5. Data directory state and permissions

ls -ld /var/lib/wazuh-indexer
ls -l /var/lib/wazuh-indexer

With this information, I can suggest the most appropriate recovery steps.

Greetings,