Wazuh indexer
The Wazuh indexer is a scalable search and analytics engine that stores and indexes events forwarded by the Wazuh manager, enabling near real-time data analysis. It manages threat intelligence updates, including decoders, detection rules, vulnerability feeds, and Indicators of Compromise (IoCs) from the Wazuh Cyber Threat Intelligence (CTI) platform.
You can install the Wazuh indexer on a single host or distribute it across multiple nodes in a cluster configuration. The cluster configuration provides scalability, high availability, and improved performance.
Check the requirements below and choose an installation method to start installing the Wazuh indexer.
Assisted installation: Install this component by running an assistant that automates the installation and configuration process.
Step-by-step installation: Install this component by following detailed step-by-step instructions.
Requirements
Check the recommended operating systems and hardware requirements for the Wazuh indexer installation. Make sure that your system environment meets all requirements and that you have root user privileges.
Recommended operating systems
The Wazuh indexer requires a 64-bit Intel, AMD, or ARM Linux processor (x86_64/AMD64 or AARCH64/ARM64 architecture). Wazuh recommends the following operating system versions:
Amazon Linux 2023
Ubuntu 24.04, 26.04
Red Hat Enterprise Linux 9, 10
Hardware requirements
You can install the Wazuh indexer as a single-node or multi-node cluster.
Hardware requirements for each node:
Minimum
Recommended
Component
RAM (GB)
CPU (cores)
RAM (GB)
CPU (cores)
Wazuh indexer
8
4
32
8
Disk space requirements: The amount of disk space required depends on the generated events per second (EPS). This table details the estimated disk space needed per agent to store 90 days of events on a Wazuh indexer server, depending on the type of monitored endpoints.
Monitored endpoints
EPS
Storage in Wazuh indexer(GB/90 days)Servers
0.25
3.7
Workstations
0.1
1.5
Network devices
0.5
7.4
For example, for an environment with 80 workstations, 10 servers, and 10 network devices, the storage needed on the Wazuh indexer server for 90 days of events is 231 GB.
Required ports
Make sure that your firewall allows the following traffic to every Wazuh indexer node:
Port |
From |
Purpose |
|---|---|---|
9200/TCP |
Wazuh manager, Wazuh dashboard, and other Wazuh indexer nodes |
Wazuh indexer REST API |
9300 - 9400/TCP |
Other Wazuh indexer nodes |
Cluster communication |