New Wazuh indexer node

Using the validation script

1. Create a validate-cluster.sh script with the following content to automate the checks. The script lists the cluster nodes, retrieves the cluster health, and confirms that the given node is a member of a healthy cluster. It distinguishes a node that is missing from the cluster from a node that cannot be reached or rejects the credentials, so a failed check always names its cause:

   #!/bin/bash
   # Wazuh indexer cluster validation script
   # Usage: bash validate-cluster.sh <NODE_NAME> <INDEXER_IP_ADDRESS> <INDEXER_USERNAME> <INDEXER_PASSWORD>
   #
   # Lists the cluster nodes, retrieves the cluster health, and confirms that the
   # given node is a member of the cluster. The credentials are handed to curl
   # through its configuration input instead of its command line, so they do not
   # appear in the process list while the requests run.
   #
   # Exit codes: 0 = validation passed (a yellow cluster is reported as a warning)
   #             1 = validation failed, or the cluster could not be queried
   
   NODE_NAME=$1
   INDEXER_IP=$2
   INDEXER_USER=$3
   INDEXER_PASSWORD=$4
   
   if [ -z "$NODE_NAME" ] || [ -z "$INDEXER_IP" ] || [ -z "$INDEXER_USER" ] || [ -z "$INDEXER_PASSWORD" ]; then
     echo "Usage: bash validate-cluster.sh <NODE_NAME> <INDEXER_IP_ADDRESS> <INDEXER_USERNAME> <INDEXER_PASSWORD>"
     exit 1
   fi
   
   if ! command -v curl > /dev/null 2>&1; then
     echo "FAIL: curl is not installed on this host"
     exit 1
   fi
   
   BASE="https://$INDEXER_IP:9200"
   
   # Escape backslashes and double quotes so that any password is valid inside the
   # quoted value of the curl configuration.
   CURL_USER=$(printf '%s:%s' "$INDEXER_USER" "$INDEXER_PASSWORD" | sed 's/[\\"]/\\&/g')
   
   # request <path>
   # Prints the response body followed by the HTTP status code on the last line.
   # 000 means that no connection could be established.
   request() {
     printf 'user = "%s"\n' "$CURL_USER" | curl -s -k -K - --connect-timeout 10 --max-time 30 -w '\n%{http_code}' "$BASE/$1"
   }
   
   RESPONSE=$(request "_cat/nodes?v")
   STATUS=${RESPONSE##*$'\n'}
   NODES=${RESPONSE%$'\n'*}
   NODES=${NODES%$'\n'}
   
   case "$STATUS" in
     200)
       ;;
     000)
       echo "FAIL: cannot connect to $BASE. Confirm that the Wazuh indexer service is running on $INDEXER_IP and that port 9200 is reachable from this host."
       exit 1
       ;;
     401|403)
       echo "FAIL: the Wazuh indexer rejected the credentials for user $INDEXER_USER (HTTP $STATUS). Check the username and password."
       exit 1
       ;;
     *)
       echo "FAIL: unexpected response from $BASE (HTTP $STATUS):"
       echo "$NODES"
       exit 1
       ;;
   esac
   
   RESPONSE=$(request "_cat/nodes?h=name")
   NODE_NAMES=${RESPONSE%$'\n'*}
   
   RESPONSE=$(request "_cluster/health?pretty")
   HEALTH=${RESPONSE%$'\n'*}
   HEALTH=${HEALTH%$'\n'}
   
   echo "$NODES"
   echo "$HEALTH"
   
   # Match the node name exactly, so that indexer-1 does not match indexer-10.
   if printf '%s\n' "$NODE_NAMES" | tr -d '[:blank:]' | grep -qx -- "$NODE_NAME"; then
     echo "PASS: node $NODE_NAME is listed in the cluster"
   else
     echo "FAIL: node $NODE_NAME is not listed in the cluster"
     exit 1
   fi
   
   CLUSTER_STATUS=$(printf '%s\n' "$HEALTH" | sed -n 's/.*"status" *: *"\([a-z]*\)".*/\1/p' | head -n 1)
   
   case "$CLUSTER_STATUS" in
     green)
       echo "PASS: the cluster status is green"
       ;;
     yellow)
       echo "WARNING: the cluster status is yellow. One or more replica shards are unassigned. Review GET _cat/shards?v before continuing."
       ;;
     red)
       echo "FAIL: the cluster status is red. One or more primary shards are unassigned. Review GET _cat/shards?v and GET _cluster/allocation/explain?pretty."
       exit 1
       ;;
     *)
       echo "WARNING: could not determine the cluster status from the response above."
       ;;
   esac
   

2. Run the script against any Wazuh indexer node, passing the name of the new node:

   # bash ./validate-cluster.sh <NEW_WAZUH_INDEXER_NODE_NAME> <NEW_WAZUH_INDEXER_IP> <INDEXER_USERNAME> <INDEXER_PASSWORD>
   

   A successful validation ends with the following results:

   Check	Result
   Node membership	PASS: node indexer-2 is listed in the cluster
   Cluster health	PASS: the cluster status is green
   Cluster health	WARNING: the cluster status is yellow. One or more replica shards are unassigned. Review GET _cat/shards?v before continuing.

   Note

   A yellow result exits with code 0 because replicas can still be allocating on a cluster that was just changed. A red result, an unreachable node, rejected credentials, or a node that is not listed all exit with code 1.

Using the Wazuh dashboard console and the Wazuh indexer API

You can run the same checks manually from the Wazuh dashboard console, at Indexer management > Dev Tools, or with the Wazuh indexer API.

Replace <INDEXER_USERNAME>, <INDEXER_PASSWORD>, and <INDEXER_IP_ADDRESS> with the Wazuh indexer username, password, and IP address values: