Cluster management

Interpreting the outputs

Verifying the node with GET / returns the node name, the cluster name, and the version information:

Listing the nodes with GET _cat/nodes?v in a healthy three-node cluster produces an output similar to the following. The asterisk in the cluster_manager column marks the elected cluster manager node:

Checking the cluster health with GET _cluster/health?pretty returns the overall state of the cluster:

The status field takes one of the following values:

Replica shards

Wazuh creates its indices with index.auto_expand_replicas set to 0-1. The setting resolves to no replica on a single-node deployment, so that deployment reports green rather than yellow, and to one replica as soon as a second Wazuh indexer node joins. The Wazuh data streams that hold event and state data need no change.

Verify the replica configuration after you build a multi-node cluster, after you enable new detection content, and after an upgrade. Replace <INDEXER_USERNAME>, <INDEXER_PASSWORD>, and <WAZUH_INDEXER_IP> with the Wazuh indexer credentials and the IP address of any Wazuh indexer node.

1. Confirm that the Wazuh indices carry the automatic replica setting. Every Wazuh index should return 0-1.

   Wazuh dashboard console	Wazuh indexer API
   GET wazuh-*/_settings?filter_path=**.auto_expand_replicas,**.number_of_replicas&expand_wildcards=all	curl -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD> "https://<WAZUH_INDEXER_IP>:9200/wazuh-*/_settings?filter_path=**.auto_expand_replicas,**.number_of_replicas&expand_wildcards=all"

   The command output looks similar to this:

   {
     ".ds-wazuh-events-v5-system-activity-000001": {
       "settings": {
         "index": {
           "auto_expand_replicas": "0-1"
         }
       }
     },
     ".ds-wazuh-active-responses-000001": {
       "settings": {
         "index": {
           "auto_expand_replicas": "0-1"
         }
       }
     },
     ...
   }
   

   An index that returns number_of_replicas without auto_expand_replicas has a fixed replica count. Apply the setting to it with the command in step 3.

2. Confirm that no Wazuh index is left without a replica. On a cluster with two or more nodes, this command returns no rows.

   Wazuh dashboard console	Wazuh indexer API
   GET _cat/indices/wazuh-*?v&h=index,pri,rep,health&s=rep,index&expand_wildcards=all	curl -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD> "https://<WAZUH_INDEXER_IP>:9200/_cat/indices/wazuh-*?v&h=index,pri,rep,health&s=rep,index&expand_wildcards=all" | awk '$3 == 0'

   The command output looks similar to this:

   index                                          pri rep health
   .ds-wazuh-events-v5-system-activity-000001       1   1 green
   .ds-wazuh-active-responses-000001                1   1 green
   .ds-wazuh-events-raw-v5-000001                   1   1 green
   ...
   

   The Wazuh dashboard console command lists every index sorted by replica count, so read the rows at the top of the output. Every row should show 1 in the rep column. The Wazuh indexer API command filters the list down to the indices with a replica count of 0 and prints nothing when the configuration is correct. A Wazuh index with 0 in the rep column on a multi-node cluster has a fixed replica count. Apply the setting to it with the command in step 3.

   Note

   Running the same command without the wazuh-* filter also returns the internal indices of the OpenSearch plugins. Several of those are created with a single copy of their data by design, so they appear with 0 in the rep column on a healthy cluster. Do not change them.

3. Apply the automatic replica setting to a Wazuh index that failed step 1 or step 2. Replace <INDEX_NAME> with the name of that index and repeat for each one.

   Wazuh dashboard console	Wazuh indexer API
   PUT <INDEX_NAME>/_settings { "index": { "auto_expand_replicas": "0-1" } }	curl -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD> -XPUT "https://<WAZUH_INDEXER_IP>:9200/<INDEX_NAME>/_settings" -H 'Content-Type: application/json' -d '{"index": {"auto_expand_replicas": "0-1"}}'

   The command output looks similar to this:

   {"acknowledged":true}
   

   Note

   Do not send one request that covers several indices with a wildcard. The Wazuh indexer applies a settings request to all of its targets or to none of them, so a single rejected index makes the whole request fail and nothing is changed. curl exits with code 0 in that case, so confirm that each response contains "acknowledged": true.