Wazuh indexer connector

The Wazuh indexer connector handles data exchange between the Wazuh manager and the Wazuh indexer. It replaces Filebeat, which shipped alerts and archived events from the Wazuh manager to the Wazuh indexer in Wazuh 4.x. The indexer connector is a shared library rather than a standalone daemon. It is linked to the Wazuh normalization engine, vulnerability detection service, and inventory synchronization service, which use it to exchange data with the Wazuh indexer.

The indexer connector transports data in the following flows:

Outbound: The Wazuh manager sends processed events, vulnerability data, and agent state documents to the Wazuh indexer for indexing, storage, search, and detection.
Inbound: The Wazuh manager retrieves content such as decoders, integrations, policies, key-value databases, and indicator of compromise (IOC) databases. It also retrieves runtime configuration for the Wazuh normalization engine. Events generated by the Wazuh normalization engine follow the Wazuh Common Schema (WCS) and synchronizes its state with the Wazuh indexer to ensure data consistency and reliability.

The indexer connector establishes TLS-secured connections to the Wazuh indexer. It supports mutual TLS authentication using a client certificate and private key. When username and password authentication is configured, the connector reads the credentials from the Wazuh keystore rather than storing them in the configuration file.

Warning

The indexer connector uses in-memory buffering. It discards buffered documents when the Wazuh manager stops or restarts. Ensure that the Wazuh indexer cluster can handle the expected data volume and event rate rather than relying on the Wazuh manager to absorb sustained indexing delays.

Configuration

Configure the Wazuh indexer connector in the <indexer> block of the /var/wazuh-manager/etc/wazuh-manager.conf file on the Wazuh manager. The default configuration is shown below:

<wazuh_config>
  ...
  <indexer>
    <hosts>
      <host>https://127.0.0.1:9200</host>
    </hosts>
    <ssl>
      <certificate_authorities>
        <ca>etc/certs/root-ca.pem</ca>
      </certificate_authorities>
      <certificate>etc/certs/indexer-connector.pem</certificate>
      <key>etc/certs/indexer-connector-key.pem</key>
    </ssl>
  </indexer>
  ...
</wazuh_config>

Where:

<indexer> specifies the configuration options for the Wazuh indexer connector.
<hosts> specifies a list of Wazuh indexer nodes to connect to. Use the <host> option to set up each node connection.
<host> specifies the Wazuh indexer node URL or IP address to connect to. For example, https://192.168.3.2:9230. The default value is set to the loopback address https://127.0.0.1:9200.
<ssl> specifies the configuration options for the SSL parameters.
<certificate_authorities> specifies a path to one or more CA certificates used to verify the Wazuh indexer TLS certificate. Use the <ca> option for setting up each CA certificate file path.
<ca> specifies the root CA certificate for HTTPS server verifications. The default value is etc/certs/root-ca.pem. The allowed value is a path to a PEM-encoded CA certificate (relative or absolute).
<certificate> specifies the path to the Wazuh manager client TLS certificate for mutual authentication with the Wazuh indexer. The default value is etc/certs/indexer-connector.pem. The allowed value is any path to a PEM-encoded certificate (relative or absolute).
<key> specifies the path to the private key corresponding to the client certificate. The default value is etc/certs/indexer-connector-key.pem. The allowed value is any path to a PEM-encoded private key (relative or absolute).

You can learn more about the available configuration options in the indexer section of the reference guide.