Wazuh indexer

NFS server

1. Create the snapshot directory:

   # mkdir -p /mnt/snapshots
   

2. Install and start the NFS service.

   • For RPM-based distributions:

     # yum install -y nfs-utils
     # systemctl enable nfs-server
     # systemctl start nfs-server
     

   • For Debian-based distributions:

     # apt -y install nfs-kernel-server
     # systemctl enable nfs-kernel-server
     # systemctl start nfs-kernel-server
     

3. Configure the snapshot directory as an NFS export:

   # echo "/mnt/snapshots <NETWORK_ADDRESS/CIDR>(rw,sync,no_root_squash,no_subtree_check)" >> /etc/exports
   

   Replace <NETWORK_ADDRESS/CIDR> with the network containing the Wazuh indexer nodes. For example, 192.168.33.0/24.

4. Apply the NFS configuration:

   # exportfs -a
   

Configure the Wazuh indexers

Perform the following steps on every Wazuh indexer node in the source Wazuh 4.x cluster and destination Wazuh 5.x cluster.

1. Create the snapshot repository directory:

   # mkdir -p /mnt/snapshots
   

2. Install the NFS client.

   • RPM-based:

     # yum install -y nfs-utils
     

   • Debian-based:

     # apt -y install nfs-common
     

3. Mount the shared NFS directory:

   # mount -t nfs <NFS_SERVER_IP>:/mnt/snapshots /mnt/snapshots
   

   Replace <NFS_SERVER_IP> with the IP address of the NFS server configured in the previous section.

4. Grant the Wazuh indexers access to the directory:

   # chown wazuh-indexer:wazuh-indexer /mnt/snapshots
   

5. Add the snapshot repository path to /etc/wazuh-indexer/opensearch.yml:

   path.repo:
     - /mnt/snapshots
   

6. Restart the Wazuh indexer:

   # systemctl restart wazuh-indexer
   

7. Verify the directory ownership:

   # ls -ld /mnt/snapshots
   

   Note

   In a distributed deployment, mount the shared directory and configure path.repo on every Wazuh indexer node in the cluster. In an all-in-one deployment, perform these steps on the host running the Wazuh indexer.

Set up snapshot repository on Wazuh 4.x

On the Wazuh 4.x dashboard, perform the following steps:

1. Click the ☰ menu, navigate to Indexer management > Snapshot Management > Repositories, and select Create repository to create a new snapshot repository.

2. Enter a Repository name, select the repository type Shared file system, enter the repository Location /mnt/snapshots, and select Add to register the new repository.

   

Take a snapshot of the Wazuh 4.x indices

On the Wazuh 4.x dashboard, perform the following steps:

1. Click the ☰ menu, navigate to Indexer management > Snapshot Management > Snapshots.

2. Select Take snapshot and enter a Snapshot name.

3. Select only the Wazuh data indices that you want to migrate.

   Warning

   Do not include system indices or the cluster state in the migration snapshot. The snapshot is intended to transfer Wazuh 4.x historical data to the new Wazuh 5.x deployment, not the Wazuh 4.x indexer configuration.

4. Select the repository you created earlier to store the snapshots.

5. Ensure Include global state is not selected in the Advanced options to prevent the snapshot from including cluster-level configuration.

6. Click Add to create a new snapshot. The snapshot files are saved in the repository location /mnt/snapshots.

   
   

Set up a snapshot repository on Wazuh 5.x

Run the command below on the Wazuh 5.x indexer node to set up a read-only snapshot repository:

# curl -sk -X PUT \
  --cert /etc/wazuh-indexer/certs/admin.pem \
  --key /etc/wazuh-indexer/certs/admin-key.pem \
  "https://<WAZUH_INDEXER_IP>:9200/_snapshot/Wazuh-4x-migration" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "fs",
    "settings": {
      "location": "/mnt/snapshots",
      "readonly": true
    }
  }'

The command output looks similar to this:

{"acknowledged":true}

Replace <WAZUH_INDEXER_IP> with the IP address of the Wazuh 5.x indexer.

Restoring the snapshot on Wazuh 5.x

Perform the following steps on the Wazuh 5.x deployment.

1. On the Wazuh dashboard, navigate to Indexer management > Snapshot Management > Snapshots. The snapshot created on the Wazuh 4.x deployment is available to the Wazuh 5.x deployment through the shared /mnt/snapshots repository. Select the migration snapshot, then click Restore.

   

2. Click Restore snapshot.

   

   Note

   You can choose to restore specific indices or rename the indices. In the image above, we add the prefix restored_ to the restored index names.

   Warning

   Do not restore system indices or the global cluster state into the Wazuh 5.x deployment (for example, .kibana*, .opendistro*).

3. Navigate to Indexer management > Indexes on the Wazuh dashboard, and filter with the prefix restored_ to view the restored indices.

   

4. Create an index pattern to retrieve the indices' data. On the Wazuh dashboard, navigate to Dashboards management > Index patterns, then click on Create index pattern.

   

5. Set the Index pattern name, then click on Next step. In the image below, we use the index pattern name restored_wazuh*.

   

6. Set the Time field. From the drop-down menu, select timestamp, then click Create index pattern.

   

7. Click the ☰ menu, navigate to Discover on the Wazuh dashboard to verify that the migrated indices are available. Select the Index pattern (restored_wazuh*) created in the previous step to view the migrated index data.

   

From the Discover page, you can explore and search the migrated index data using the Wazuh dashboard.