Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The index-pattern is not created when it does not have a Wazuh template #2620

Closed
SitoRBJ opened this issue Nov 13, 2020 · 0 comments
Closed
Assignees
Labels
type/bug Bug issue

Comments

@SitoRBJ
Copy link

SitoRBJ commented Nov 13, 2020

Wazuh Elastic Rev
4.0 7.9.1 4008

Description
When creating an Open Distro environment without adding the Wazuh template or a Wazuh API, the index pattern is not created.

Steps to reproduce

  1. Do not add Wazuh template. Disable the template check. Have a default API in the wazuh.yml
  2. Logging in Open Distro Kibana

Screenshots

image

Additional context

  • wazuh.yml
---
#
# Wazuh app - App configuration file
# Copyright (C) 2015-2020 Wazuh, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Find more information about this on the LICENSE file.
#
# ======================== Wazuh app configuration file ========================
#
# Please check the documentation for more information on configuration options:
# https://documentation.wazuh.com/current/installation-guide/index.html
#
# Also, you can check our repository:
# https://github.com/wazuh/wazuh-kibana-app
#
# ------------------------------- Index patterns -------------------------------
#
# Default index pattern to use.
pattern: "*:wazuh-alerts"
#
# ----------------------------------- Checks -----------------------------------
#
# Defines which checks must to be consider by the healthcheck
# step once the Wazuh app starts. Values must to be true or false.
#checks.pattern : true
checks.template: false
#checks.api     : true
#checks.setup   : true
#checks.metaFields  : true
#
# --------------------------------- Extensions ---------------------------------
#
# Defines which extensions should be activated when you add a new API entry.
# You can change them after Wazuh app starts.
# Values must to be true or false.
#extensions.pci       : true
#extensions.gdpr      : true
#extensions.hipaa     : true
#extensions.nist      : true
#extensions.tsc       : true
#extensions.audit     : true
#extensions.oscap     : false
#extensions.ciscat    : false
#extensions.aws       : false
#extensions.gcp       : false
#extensions.virustotal: false
#extensions.osquery   : false
#extensions.docker    : false
#
# ---------------------------------- Timeout ----------------------------------
#
# Defines maximum timeout to be used on the Wazuh app requests.
# It will be ignored if it is bellow 1500.
# It means milliseconds before we consider a request as failed.
# Default: 20000
#timeout: 20000
#
# -------------------------------- API selector --------------------------------
#
# Defines if the user is allowed to change the selected
# API directly from the Wazuh app top menu.
# Default: true
api.selector: true
#
# --------------------------- Index pattern selector ---------------------------
#
# Defines if the user is allowed to change the selected
# index pattern directly from the Wazuh app top menu.
# Default: true
#ip.selector: true
#
# List of index patterns to be ignored
#ip.ignore: []
#
# -------------------------------- X-Pack RBAC ---------------------------------
#
# Custom setting to enable/disable built-in X-Pack RBAC security capabilities.
# Default: enabled
#xpack.rbac.enabled: true
#
# ------------------------------ wazuh-monitoring ------------------------------
#
# Custom setting to enable/disable wazuh-monitoring indices.
# Values: true, false, worker
# If worker is given as value, the app will show the Agents status
# visualization but won't insert data on wazuh-monitoring indices.
# Default: true
#wazuh.monitoring.enabled: true
#
# Custom setting to set the frequency for wazuh-monitoring indices cron task.
# Default: 900 (s)
#wazuh.monitoring.frequency: 900
#
# Configure wazuh-monitoring-* indices shards and replicas.
wazuh.monitoring.shards: 1
wazuh.monitoring.replicas: 0
#
# Configure wazuh-monitoring-* indices custom creation interval.
# Values: h (hourly), d (daily), w (weekly), m (monthly)
# Default: d
#wazuh.monitoring.creation: d
#
# Default index pattern to use for Wazuh monitoring
#wazuh.monitoring.pattern: wazuh-monitoring-*
#
#
# --------------------------------- wazuh-cron ----------------------------------
#
# Customize the index prefix of predefined jobs
# This change is not retroactive, if you change it new indexes will be created
# cron.prefix: test
#
# ------------------------------ wazuh-statistics -------------------------------
#
# Custom setting to enable/disable statistics tasks.
#cron.statistics.status: true
#
# Enter the ID of the APIs you want to save data from, leave this empty to run
# the task on all configured APIs
#cron.statistics.apis: []
#
# Define the frequency of task execution using cron schedule expressions
#cron.statistics.interval: 0 0 * * * *
#
# Define the name of the index in which the documents are to be saved.
#cron.statistics.index.name: statistics
#
# Define the interval in which the index will be created
#cron.statistics.index.creation: w
#
# ---------------------------- Hide manager alerts ------------------------------
# Hide the alerts of the manager in all dashboards and discover
#hideManagerAlerts: false
#
# ------------------------------- App logging level -----------------------------
# Set the logging level for the Wazuh App log files.
# Default value: info
# Allowed values: info, debug
#logs.level: info
#
# -------------------------------- Enrollment DNS -------------------------------
# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
# Wazuh server address
# Default value: ''
#enrollment.dns: ''
#
# Wazuh registration password
# Default value: ''
#enrollment.password: ''
#
#-------------------------------- API entries -----------------------------------
#The following configuration is the default structure to define an API entry.
#
#hosts:
#  - <id>:
#     url: http(s)://<url>
#     port: <port>
#     username: <user>
#     password: <password>
hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: wazuh-wuibash-4.2$

NOTE: wazuh-alerts is an alias

  • Logs
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"Kibana index: .kibana"}
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"App revision: 4008"}
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"Total RAM: 7681MB"}
{"date":"2020-11-13T16:31:00.152Z","level":"info","location":"initialize:checkKnownFields","message":"Default index pattern not found, creating it..."}
{"date":"2020-11-13T16:31:00.638Z","level":"info","location":"monitoring:init","message":"Didn't find wazuh-monitoring- index pattern for Kibana. Proceeding to create it..."}
{"date":"2020-11-13T16:31:00.827Z","level":"info","location":"monitoring:configureKibana","message":"Created index pattern: wazuh-monitoring-*"}
{"date":"2020-11-13T16:31:01.254Z","level":"error","location":"monitoring:checkAndSaveStatus","message":"connect ECONNREFUSED 127.0.0.1:55000"}
  • Indices
curl -k -u elastic "https://odfe:9200/_cat/indices?s=index"
green  open .kibana_1                    _ECnB7rUR0KfXZQb3OFd5w 1 0 22 5 72.3kb 72.3kb
yellow open .kibana_231986579_wazuhadmin xbnHDsgcSyq1SRv-hDnT3Q 1 1 10 0   47kb   47kb
green  open .opendistro_security         qbaV8mcBSn2QBKewcY7kdw 1 0  9 0 51.4kb 51.4kb
green  open wazuh-monitoring-2020.11.13  QDA4QX0pQxWS7wKsi37Bdg 1 0  0 0   208b   208b

Regards

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Bug issue
Projects
None yet
Development

No branches or pull requests

4 participants