Wazuh indexer connector

The Wazuh indexer connector handles data exchange between the Wazuh manager and the Wazuh indexer. It replaces Filebeat, which shipped alerts and archived events from the Wazuh manager to the Wazuh indexer in Wazuh 4.x. The indexer connector is a shared library rather than a standalone daemon. It is linked to the Wazuh normalization engine, vulnerability detection service, and inventory synchronization service, which use it to exchange data with the Wazuh indexer. The wazuh-manager-clusterd daemon reads the same <indexer> block and reaches the Wazuh indexer through its own client.

The indexer connector transports data in the following flows:

Outbound: The Wazuh manager sends processed events, vulnerability data, and agent state documents to the Wazuh indexer for indexing, storage, search, and detection.
Inbound: The Wazuh manager retrieves content such as decoders, integrations, policies, key-value databases, and indicator of compromise (IOC) databases. It also retrieves runtime configuration for the Wazuh normalization engine. Events generated by the Wazuh normalization engine follow the Wazuh Common Schema (WCS). The normalization engine also synchronizes its state with the Wazuh indexer to ensure data consistency and reliability.

The indexer connector establishes TLS-secured connections to the Wazuh indexer. It supports mutual TLS authentication using a client certificate and private key. The connector also authenticates with a username and password, which it reads from the Wazuh keystore rather than from the configuration file.

Warning

The indexer connector uses in-memory buffering. It discards buffered documents when the Wazuh manager stops or restarts. Ensure that the Wazuh indexer cluster can handle the expected data volume and event rate rather than relying on the Wazuh manager to absorb sustained indexing delays.

Configuration

Configure the Wazuh indexer connector in the <indexer> block of the /etc/wazuh-manager/wazuh-manager.conf file on the Wazuh manager. The default configuration is shown below:

<wazuh_config>
  ...
  <indexer>
    <hosts>
      <host>https://127.0.0.1:9200</host>
    </hosts>
    <ssl>
      <certificate_authorities>
        <ca>/etc/wazuh-manager/certs/indexer-ca.pem</ca>
      </certificate_authorities>
      <certificate>/etc/wazuh-manager/certs/indexer-connector.pem</certificate>
      <key>/etc/wazuh-manager/certs/indexer-connector-key.pem</key>
    </ssl>
  </indexer>
  ...
</wazuh_config>

Where:

<indexer> specifies the configuration options for the Wazuh indexer connector.
<hosts> specifies a list of Wazuh indexer nodes to connect to. Use the <host> option to set up each node connection.
<host> specifies the URL of a Wazuh indexer node to connect to. The URL must start with http:// or https://. For example, https://192.168.3.2:9230. The installer sets it to the loopback address https://127.0.0.1:9200.
<ssl> specifies the configuration options for the SSL parameters.
<certificate_authorities> specifies a path to one or more certificate authority (CA) certificates used to verify the Wazuh indexer TLS certificate. Use the <ca> option for setting up each CA certificate file path.
<ca> specifies the root CA certificate for HTTPS server verifications. The installer sets it to /etc/wazuh-manager/certs/indexer-ca.pem, the CA of the Wazuh indexer. The schema default is an empty list, which makes the connector use the system trust store. The allowed value is an absolute path to a PEM-encoded CA certificate in /etc/wazuh-manager/certs.
<certificate> specifies the path to the Wazuh manager client TLS certificate for mutual authentication with the Wazuh indexer. The installer sets it to /etc/wazuh-manager/certs/indexer-connector.pem. The schema default is empty, which means no client certificate. Set <certificate> and <key> together. The client certificate must include the clientAuth extended key usage. The allowed value is an absolute path to a PEM-encoded certificate in /etc/wazuh-manager/certs.
<key> specifies the path to the private key corresponding to the client certificate. The installer sets it to /etc/wazuh-manager/certs/indexer-connector-key.pem. The schema default is empty. Set it together with <certificate>. The allowed value is an absolute path to a PEM-encoded private key in /etc/wazuh-manager/certs.

You can learn more about the available configuration options in the indexer section of the reference guide.