Wazuh dashboard

Wazuh dashboard configuration

The Wazuh dashboard configuration defines how the dashboard connects to the Wazuh manager, and it configures dashboard behavior, custom branding, health checks, and user preferences.

Review the existing Wazuh 4.x configuration and recreate the supported settings manually in the Wazuh 5.x deployment. Do not copy the Wazuh 4.x /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration directly, because Wazuh 5.x stores dashboard configuration in different locations.

The following configuration locations are commonly reviewed during the migration.

By default, you manage Advanced Settings per tenant through the Wazuh dashboard. You can also configure them globally using uiSettings.overrides in opensearch_dashboards.yml.

Configuration changes

Review the following configuration changes before you recreate the Wazuh dashboard configuration.

Recreate Wazuh dashboard configuration

Perform the following steps to recreate the Wazuh dashboard configuration in Wazuh 5.x.

1. Review the Wazuh dashboard 4.x configuration file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and identify any settings that differ from the default values.

2. Edit the Wazuh dashboard 5.x configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml to recreate the supported Wazuh manager API configuration. Set the URL to the Wazuh 5.x manager address. In an all-in-one deployment, use https://127.0.0.1, because the Wazuh manager API listens only on the loopback address. Use the port and run_as values from the Wazuh 4.x deployment. Keep the wazuh-internal-client user, which replaces wazuh-wui in Wazuh 5.x. Leave out the password setting, because the Wazuh dashboard reads the password from its keystore:

   wazuh_core.hosts:
     default:
       url: https://<WAZUH_MANAGER_IP_OR_HOSTNAME>
       port: <PORT>
       username: wazuh-internal-client
       run_as: true
   

3. Navigate to Dashboards Management > Advanced Settings on the Wazuh dashboard to reconfigure advanced settings. Recreate any customized settings from the Wazuh 4.x deployment. Review the following settings:

   Setting	Description
   timeout	Request timeout in milliseconds.
   enrollment.dns	Wazuh manager DNS name used in the agent deployment guide. Set this value to the Wazuh 5.x manager address.
   reports.csv.maxRows	Maximum rows allowed in exported CSV files.
   wazuh.updates.disabled	Enables or disables update notifications.

4. Restart the Wazuh dashboard service:

   # systemctl restart wazuh-dashboard
   

5. Verify that the Wazuh manager API connection succeeds. Navigate to Dashboard management > Health Check.

Custom dashboards and visualization

The Wazuh dashboard stores dashboards, visualizations, saved searches, and index patterns as saved objects in the Wazuh indexer. You can export these objects from a Wazuh 4.x deployment and import them into a Wazuh 5.x deployment.

This migration applies only to custom dashboards, visualizations, saved searches, and index patterns that users create or modify.

You can recreate the following saved object types in the Wazuh 5.x deployment.

Migrate custom dashboards and visualizations

Perform the following steps to recreate custom dashboards and visualizations in the Wazuh 5.x deployment.

1. Export the custom saved objects from the Wazuh dashboard 4.x deployment. Click the ☰ menu and navigate to Dashboards Management > Saved objects. Select the objects to export and click Export.

   Note

   Disable Include related objects before exporting the saved objects. Otherwise, the export includes the Wazuh 4.x wazuh-alerts-* index pattern, and the imported panels display no data.

2. Import the exported saved objects into the new deployment. Click the ☰ menu and navigate to Dashboards Management > Saved objects. Click Import and select the exported .ndjson file.

   Note

   When you import objects, select Check for existing objects and then Request action on conflict. When the Wazuh dashboard reports index pattern conflicts for wazuh-alerts-*, select a Wazuh 5.x index pattern, such as wazuh-findings-v5*, and click Confirm all changes. This option preserves the default objects that the Wazuh dashboard 5.x provisions. The Automatically overwrite conflicts option replaces existing objects that have the same IDs.

3. Replace references to wazuh-alerts-* with an appropriate Wazuh 5.x index pattern. Wazuh 5.x stores events and findings in category specific data streams, while the Wazuh dashboard can use broader index patterns such as wazuh-events-v5* and wazuh-findings-v5* to query multiple categories. Select the index pattern that contains the data required by the migrated visualization.

4. Update field references where required. Wazuh 5.x uses the Wazuh Common Schema (WCS) to standardize event fields. When recreating visualizations, review the fields referenced by the Wazuh 4.x visualization and identify the appropriate WCS fields for the data you want to display.

   The following table provides examples of Wazuh 4.x fields and related WCS fields in Wazuh 5.x. For the complete list of WCS fields, refer to the Wazuh Common Schema (WCS) documentation.

   Wazuh 4.x field	Wazuh 5.x field	Notes
   rule.level	wazuh.rule.level	Type changed from integer values 0–16 to values such as low, medium, high, critical, and informational. Rewrite range queries, for example, replace rule.level >= 5 with wazuh.rule.level:(medium or high or critical).
   rule.description	wazuh.rule.title	Use this field for the rule title or description shown in migrated visualizations.
   rule.id	wazuh.rule.id	Use this field to filter or aggregate by rule ID. Wazuh 5.x rule IDs are UUIDs, so filters on Wazuh 4.x numeric rule IDs don't match.
   agent.name	wazuh.agent.name	Use this field to filter or group by agent name.
   agent.id	wazuh.agent.id	Use this field to filter or group by Wazuh agent ID.
   rule.groups	wazuh.integration.name	Use this field to filter or group by the integration that generated the event.

   Note

   Field names, data types, and semantics can differ between Wazuh 4.x and Wazuh 5.x. Review the applicable WCS field before updating filters, aggregations, or saved searches in migrated visualizations.

5. After you complete the migration, verify that dashboards and visualizations display data correctly:

   • Navigate to ☰ Menu > Dashboards Management > Saved objects and verify that the expected objects are present.

   • Open each migrated dashboard and confirm that all panels load correctly.

   • Verify that visualizations return data from the expected index patterns.

   • Confirm that all filters, aggregations, and searches use valid Wazuh 5.x field names.

   • Verify that the selected time range contains data for the imported dashboards and visualizations.

   Note

   If multitenancy is enabled in the Wazuh 4.x deployment, export and import saved objects separately for each tenant. Saved objects are tenant-specific and are not shared across tenants. Import objects that you exported from a tenant in the Wazuh 4.x deployment into the corresponding tenant in the Wazuh 5.x deployment to preserve access and ownership.