You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description
When creating an Open Distro environment without adding the Wazuh template or a Wazuh API, the index pattern is not created.
Steps to reproduce
Do not add Wazuh template. Disable the template check. Have a default API in the wazuh.yml
Logging in Open Distro Kibana
Screenshots
Additional context
wazuh.yml
---
## Wazuh app - App configuration file# Copyright (C) 2015-2020 Wazuh, Inc.## This program is free software; you can redistribute it and/or modify# it under the terms of the GNU General Public License as published by# the Free Software Foundation; either version 2 of the License, or# (at your option) any later version.## Find more information about this on the LICENSE file.## ======================== Wazuh app configuration file ========================## Please check the documentation for more information on configuration options:# https://documentation.wazuh.com/current/installation-guide/index.html## Also, you can check our repository:# https://github.com/wazuh/wazuh-kibana-app## ------------------------------- Index patterns -------------------------------## Default index pattern to use.pattern: "*:wazuh-alerts"## ----------------------------------- Checks -----------------------------------## Defines which checks must to be consider by the healthcheck# step once the Wazuh app starts. Values must to be true or false.#checks.pattern : truechecks.template: false#checks.api : true#checks.setup : true#checks.metaFields : true## --------------------------------- Extensions ---------------------------------## Defines which extensions should be activated when you add a new API entry.# You can change them after Wazuh app starts.# Values must to be true or false.#extensions.pci : true#extensions.gdpr : true#extensions.hipaa : true#extensions.nist : true#extensions.tsc : true#extensions.audit : true#extensions.oscap : false#extensions.ciscat : false#extensions.aws : false#extensions.gcp : false#extensions.virustotal: false#extensions.osquery : false#extensions.docker : false## ---------------------------------- Timeout ----------------------------------## Defines maximum timeout to be used on the Wazuh app requests.# It will be ignored if it is bellow 1500.# It means milliseconds before we consider a request as failed.# Default: 20000#timeout: 20000## -------------------------------- API selector --------------------------------## Defines if the user is allowed to change the selected# API directly from the Wazuh app top menu.# Default: trueapi.selector: true## --------------------------- Index pattern selector ---------------------------## Defines if the user is allowed to change the selected# index pattern directly from the Wazuh app top menu.# Default: true#ip.selector: true## List of index patterns to be ignored#ip.ignore: []## -------------------------------- X-Pack RBAC ---------------------------------## Custom setting to enable/disable built-in X-Pack RBAC security capabilities.# Default: enabled#xpack.rbac.enabled: true## ------------------------------ wazuh-monitoring ------------------------------## Custom setting to enable/disable wazuh-monitoring indices.# Values: true, false, worker# If worker is given as value, the app will show the Agents status# visualization but won't insert data on wazuh-monitoring indices.# Default: true#wazuh.monitoring.enabled: true## Custom setting to set the frequency for wazuh-monitoring indices cron task.# Default: 900 (s)#wazuh.monitoring.frequency: 900## Configure wazuh-monitoring-* indices shards and replicas.wazuh.monitoring.shards: 1wazuh.monitoring.replicas: 0## Configure wazuh-monitoring-* indices custom creation interval.# Values: h (hourly), d (daily), w (weekly), m (monthly)# Default: d#wazuh.monitoring.creation: d## Default index pattern to use for Wazuh monitoring#wazuh.monitoring.pattern: wazuh-monitoring-*### --------------------------------- wazuh-cron ----------------------------------## Customize the index prefix of predefined jobs# This change is not retroactive, if you change it new indexes will be created# cron.prefix: test## ------------------------------ wazuh-statistics -------------------------------## Custom setting to enable/disable statistics tasks.#cron.statistics.status: true## Enter the ID of the APIs you want to save data from, leave this empty to run# the task on all configured APIs#cron.statistics.apis: []## Define the frequency of task execution using cron schedule expressions#cron.statistics.interval: 0 0 * * * *## Define the name of the index in which the documents are to be saved.#cron.statistics.index.name: statistics## Define the interval in which the index will be created#cron.statistics.index.creation: w## ---------------------------- Hide manager alerts ------------------------------# Hide the alerts of the manager in all dashboards and discover#hideManagerAlerts: false## ------------------------------- App logging level -----------------------------# Set the logging level for the Wazuh App log files.# Default value: info# Allowed values: info, debug#logs.level: info## -------------------------------- Enrollment DNS -------------------------------# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.# Wazuh server address# Default value: ''#enrollment.dns: ''## Wazuh registration password# Default value: ''#enrollment.password: ''##-------------------------------- API entries -----------------------------------#The following configuration is the default structure to define an API entry.##hosts:# - <id>:# url: http(s)://<url># port: <port># username: <user># password: <password>hosts:
- default:
url: https://localhostport: 55000username: wazuh-wuipassword: wazuh-wuibash-4.2$
NOTE: wazuh-alerts is an alias
Logs
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"Kibana index: .kibana"}
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"App revision: 4008"}
{"date":"2020-11-13T16:30:59.931Z","level":"info","location":"initialize","message":"Total RAM: 7681MB"}
{"date":"2020-11-13T16:31:00.152Z","level":"info","location":"initialize:checkKnownFields","message":"Default index pattern not found, creating it..."}
{"date":"2020-11-13T16:31:00.638Z","level":"info","location":"monitoring:init","message":"Didn't find wazuh-monitoring- index pattern for Kibana. Proceeding to create it..."}
{"date":"2020-11-13T16:31:00.827Z","level":"info","location":"monitoring:configureKibana","message":"Created index pattern: wazuh-monitoring-*"}
{"date":"2020-11-13T16:31:01.254Z","level":"error","location":"monitoring:checkAndSaveStatus","message":"connect ECONNREFUSED 127.0.0.1:55000"}
Indices
curl -k -u elastic "https://odfe:9200/_cat/indices?s=index"
green open .kibana_1 _ECnB7rUR0KfXZQb3OFd5w 1 0 22 5 72.3kb 72.3kb
yellow open .kibana_231986579_wazuhadmin xbnHDsgcSyq1SRv-hDnT3Q 1 1 10 0 47kb 47kb
green open .opendistro_security qbaV8mcBSn2QBKewcY7kdw 1 0 9 0 51.4kb 51.4kb
green open wazuh-monitoring-2020.11.13 QDA4QX0pQxWS7wKsi37Bdg 1 0 0 0 208b 208b
Regards
The text was updated successfully, but these errors were encountered:
Description
When creating an Open Distro environment without adding the Wazuh template or a Wazuh API, the index pattern is not created.
Steps to reproduce
Screenshots
Additional context
NOTE: wazuh-alerts is an alias
curl -k -u elastic "https://odfe:9200/_cat/indices?s=index" green open .kibana_1 _ECnB7rUR0KfXZQb3OFd5w 1 0 22 5 72.3kb 72.3kb yellow open .kibana_231986579_wazuhadmin xbnHDsgcSyq1SRv-hDnT3Q 1 1 10 0 47kb 47kb green open .opendistro_security qbaV8mcBSn2QBKewcY7kdw 1 0 9 0 51.4kb 51.4kb green open wazuh-monitoring-2020.11.13 QDA4QX0pQxWS7wKsi37Bdg 1 0 0 0 208b 208b
Regards
The text was updated successfully, but these errors were encountered: