Wazuh indices

Data streams

A data stream is a logical collection of backing indices that stores continuously generated, time-based data. Wazuh writes data to the stream name while managing the underlying backing indices automatically. Backing indices are the individual indices that sit behind a data stream and hold its actual data.

Each data stream is associated with an index template that defines its mappings and settings and applies its rollover and retention policy.

The following table lists the Wazuh data streams and the type of information each stores:

Stateful indices

Stateful indices store information that changes over time and reflects the current state of monitored endpoints.

Unlike data streams, stateful information is continuously updated as the monitored environment changes.

The following stateful indices are available:

Data stream lifecycle

Wazuh automatically manages data stream growth through rollover and retention policies.

A rollover occurs when the active backing index reaches a configured size or document count threshold. After rollover, new documents are written to a new backing index while existing data remains searchable.

Retention policies determine how long data is preserved before it is deleted. This approach keeps storage consumption predictable while maintaining access to the data required for investigation, threat hunting, and compliance activities.

By default, Wazuh rolls over a data stream when either of the following limits is reached:

• 20 GB primary shard size.

• 200 million documents.

The default retention periods are shown below.

The following diagram illustrates the lifecycle of a data stream:

Each lifecycle policy moves an index through two stages during its lifetime. When an index is first created, it enters the active stage, where it accepts new data. It remains in this stage until one of the configured rollover conditions, such as age or size, is met. At that point, Wazuh creates a new active index, and the previous index stops accepting new data.

The previous index is retained until its configured retention period expires. It then enters the delete stage, where Wazuh permanently removes it. If the deletion fails, Wazuh automatically retries the operation up to three times with increasing delays between attempts.

The ISM policy below keeps matching indices in the hot state while they receive data. It rolls them over when they reach 200 million documents or a 20 GB primary shard size. After the configured retention period expires, the policy moves the index to the delete state and removes it. Failed actions are retried up to three times using exponential backoff.

{
  "policy": {
    "policy_id": "<index-name>-policy",
    "description": "<POLICY_DESCRIPTION>",
    "last_updated_time": <UNIX_TIMESTAMP_IN-MILLISECONDS>,
    "schema_version": 1,
    "default_state": "hot",
    "states": [
      {
        "name": "hot",
        "actions": [
          {
            "retry": {
              "count": 3,
              "backoff": "exponential",
              "delay": "1m"
            },
            "rollover": {
              "min_doc_count": 200000000,
              "min_primary_shard_size": "20gb"
            }
          }
        ],
        "transitions": [
          {
            "state_name": "delete",
            "conditions": {
              "min_index_age": "<RETENTION_TIME>"
            }
          }
        ]
      },
      {
        "name": "delete",
        "actions": [
          {
            "retry": {
              "count": 3,
              "backoff": "exponential",
              "delay": "1m"
            },
            "delete": {}
          }
        ],
        "transitions": []
      }
    ],
    "ism_template": [
      {
        "index_patterns": [
          "wazuh-<pattern>-*"
        ],
        "priority": <PRIORITY_INT>
      }
    ]
  }
}

Enabling unclassified events storage

Wazuh agent collects logs from endpoints and forwards them to the Wazuh manager. The Wazuh manager normalizes, decodes, and enriches events and sends them to the Wazuh indexer for rule matching, indexing, and security analytics. The Wazuh dashboard allows teams to view and investigate findings, search historical events, and manage the platform. Events that match detection rules generate findings. Events that cannot be decoded or classified are stored in the wazuh-events-v5-unclassified index when unclassified event indexing is enabled for the relevant space.

Unclassified event indexing is configured per space. You can enable unclassified event indexing in the Draft or Standard space. Follow the steps below to enable the storage of unclassified events:

1. Navigate to the Security Analytics dashboard, select the space you want to enable unclassified events for, click the Actions drop-down menu, and select Edit:

   

2. Toggle on Index unclassified events, and click Save:

   

Verifying index templates

Index templates define the mappings, settings, and lifecycle policies applied to Wazuh indices and data streams.

To verify that the Wazuh templates are installed, query the Wazuh indexer from the Wazuh dashboard. Navigate to Indexer management > Dev Tools and run the query below:

GET /_index_template/wazuh-*

The response lists all deployed Wazuh index templates and the index patterns associated with each template.

{
  "index_templates": [
    {
      "name": "wazuh-findings-v5-network-activity-template",
      "index_template": {
        "index_patterns": [
          "wazuh-findings-v5-network-activity*"
        ],
        "template": {
          "settings": {
            "index": {
              "codec": "zstd",
              "mapping": {
                "nested_fields": {
                  "limit": "50"
                },
                "total_fields": {
                  "limit": "1000"
                }
              },
              "refresh_interval": "2s",
              "number_of_shards": "1",
              "auto_expand_replicas": "0-1",
              "plugins": {
                "index_state_management": {
                  "policy_id": "stream-findings-policy"
                }
              },
              "max_docvalue_fields_search": "200",
              "query": {
                "default_field": [
                  "agent.host.architecture",
                  "agent.host.ip",
                  "agent.id",
                  "agent.name",
                  "agent.version",
                  "wazuh.cluster.name",
                  "wazuh.cluster.node",
                  "wazuh.schema.version"
                ]
              },
              "number_of_replicas": "0"
            }
          }
        }
      }
    }
    ...