Wazuh indexer
The Wazuh indexer is a scalable search and analytics engine that stores and indexes events forwarded by the Wazuh manager, enabling near real-time data analysis. It manages threat intelligence updates, including decoders, detection rules, vulnerability feeds, and Indicators of Compromise (IoCs) from the Wazuh Cyber Threat Intelligence (CTI) platform.
You can install the Wazuh indexer on a single host or distribute it across multiple nodes in a cluster configuration. The cluster configuration provides scalability, high availability, and improved performance.
Check the requirements below and choose an installation method to start installing the Wazuh indexer.
All-in-one deployment: Install the Wazuh indexer, Wazuh manager, and Wazuh dashboard on one host.
Assisted installation: Install this component by running an assistant that automates the installation and configuration process.
Step-by-step installation: Install this component by following detailed step-by-step instructions.
Requirements
Check the recommended operating systems and hardware requirements for the Wazuh indexer installation. Make sure that your system environment meets all requirements and that you have root user privileges.
On Debian and Ubuntu, the Wazuh indexer package needs iproute2, openssl, and passwd. On Red Hat Enterprise Linux and Amazon Linux, it needs iproute, openssl, and shadow-utils. It opens no firewall port: open the ports in Required ports yourself. You can't install it over a Wazuh indexer 4.x. The package refuses with Upgrade from Wazuh indexer versions prior to 5.x is not supported. To move from 4.x, see the migration guide.
Recommended operating systems
The Wazuh indexer requires a 64-bit Intel, AMD, or ARM Linux processor (x86_64/AMD64 or AARCH64/ARM64 architecture). Wazuh recommends the following operating system versions:
Amazon Linux 2023
Ubuntu 24.04, 26.04
Red Hat Enterprise Linux 9, 10
Hardware requirements
You can install the Wazuh indexer as a single-node or multi-node cluster.
Hardware requirements for each node:
Minimum
Recommended
Component
RAM (GB)
CPU (cores)
RAM (GB)
CPU (cores)
Wazuh indexer
8
4
32
8
An all-in-one host runs the Wazuh indexer, Wazuh manager, and Wazuh dashboard together. For up to 25 agents, it needs 4 CPU cores and 8 GB of RAM, as in the Quickstart. Two or more Wazuh central components on one host need at least 8 GB of RAM and 4 CPU cores.
Disk space requirements: The amount of disk space required depends on the generated events per second (EPS). This table shows the disk space each agent needs on a Wazuh indexer server for 90 days of events, by type of monitored endpoint.
Monitored endpoints
EPS
Storage in Wazuh indexer(GB/90 days)Servers
0.25
3.7
Workstations
0.1
1.5
Network devices
0.5
7.4
For example, 80 workstations, 10 servers, and 10 network devices need 231 GB on the Wazuh indexer server for 90 days of events.
Required ports
Make sure that your firewall allows the following traffic to every Wazuh indexer node:
Port |
From |
Purpose |
|---|---|---|
9200/TCP |
Wazuh manager, Wazuh dashboard, and other Wazuh indexer nodes |
Wazuh indexer REST API |
9300 - 9400/TCP |
Other Wazuh indexer nodes |
Cluster communication |
All-in-one deployment
You can install the Wazuh indexer, Wazuh manager, and Wazuh dashboard on one host with either installation method. Size the host as Hardware requirements describes for an all-in-one host.
The Quickstart is the fastest way to install them on one host. With the installation assistant, follow the assisted installation sections of the Wazuh indexer, Wazuh manager, and Wazuh dashboard on that host, in that order. Initial configuration says which config.yml values to use and which step to skip for an all-in-one installation.
With the step-by-step method, follow their step-by-step sections on that host, in the same order. Each section says which steps to skip when the components share a host.