Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No template found for the selected index pattern in CCS #3745

Closed
dariommr opened this issue Dec 21, 2021 · 1 comment · Fixed by #3783
Closed

No template found for the selected index pattern in CCS #3745

dariommr opened this issue Dec 21, 2021 · 1 comment · Fixed by #3783
Labels
request/operational Operational requests type/bug Bug issue

Comments

@dariommr
Copy link
Member

Wazuh Elastic Rev Security
4.2.5 7.10.2 4xxx ODFE
Browser
Any

Description
In an environment configured as Cross Cluster Search where we have 2 remote clusters (remote1_prod, remote2_prod), when the health check is done we have the error:
image

This was working without issues in Wazuh 4.1.5, and when we upgraded to 4.2.5 this started to happen.

Steps to reproduce

  1. Install Wazuh 4.1.5 and configure an environment of Elasticsearch Cross Cluster search.
  2. Upgrade the environment to 4.2.5
  3. Execute the Wazuh App Health Check.

Expected Result

  1. All health checks ok.

Actual Result

  1. Error in templates for the index patterns of the remote clusters.

Troubleshooting

  1. Tried adding the index patterns to the template and that is not possible because the : are not accepted:
    image
  2. Tried with this configurations in the Wazuh App:
    image
    image
    But without success, same error.

Thank you in advance!

@Desvelao
Copy link
Member

Desvelao commented Jan 5, 2022

From Wazuh app version 4.2.0, the configuration for checks.template and checks.fields was unified under the checks.pattern. This does some environments can't pass the Alerts index pattern in the health check due to the template check. The PR that unified the check was #3311.

There is a PR that runs the check depending on the app configuration #3783. The planning is this change be available in Wazuh app 4.3.0.

Related issue #3765

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
request/operational Operational requests type/bug Bug issue
Projects
None yet
3 participants