Troubleshooting

Remediation

The dashboard initializes the saved objects with the index definitions when it starts, so the suggested solution is to restart the service to initialize the saved objects again.

1. Restart the Wazuh dashboard service.

   Systemd

   SysV init

   # systemctl restart wazuh-dashboard
   

   # service wazuh-dashboard restart
   

   This will initialize the index with the required mappings.

   Note

   If the index contains data but has missing objects, the dashboard will migrate the data to a new index with the missing objects added.

If the restart does not solve the problem, we can execute this process manually:

1. Stop the Wazuh dashboard service.

   Systemd

   SysV

   # systemctl stop wazuh-dashboard
   

   # service wazuh-dashboard stop
   

2. Identify the index or indices that have the wrong field mappings, this depends on the logged user that experiences the problem or the selected tenant. By default, the index name should start with .kibana.

3. Get the field mapping for the type field for the indices that store the saved objects.

   # curl https://<WAZUH_INDEXER_IP>:9200/.kibana*/_mapping/field/type?pretty -u <wazuh_indexer_user>:<wazuh_indexer_password> -k
   

   {
     ".kibana" : {
       "mappings" : {
         "type" : {
           "full_name" : "type",
           "mapping" : {
             "type" : {
               "type" : "text",
               "fields" : {
                 "keyword" : {
                   "type" : "keyword",
                   "ignore_above" : 256
                 }
               }
             }
           }
         }
       }
     },
     ".kibana_92668751_admin_1" : {
       "mappings" : {
         "type" : {
           "full_name" : "type",
           "mapping" : {
             "type" : {
               "type" : "text",
               "fields" : {
                 "keyword" : {
                   "type" : "keyword",
                   "ignore_above" : 256
                 }
               }
             }
           }
         }
       }
     }
   }
   

   In the output, we can see type field mapping for the .kibana and .kibana_92668751_admin_1 indices. Note that the field mapping type for the type field is text and that it contains a subfield called keyword. This is not the expected result, the type field should be keyword, not text, and it should not include the keyword subfield.

   These errors happened because there was no template that specified the appropriate field mappings at the time the saved object data was indexed. To solve the errors, we need to remove the index and rebuild it.

4. Delete the index or indices that store the saved objects with the wrong field mapping.

   # curl https://<WAZUH_INDEXER_IP>:9200/<INDEX/INDICES_SEPARATED_BY_COMMAS> -u <wazuh_indexer_user>:<wazuh_indexer_password> -k -XDELETE
   

   {“acknowledged”:true}
   

5. Restart the Wazuh dashboard service.

   Systemd

   SysV init

   # systemctl restart wazuh-dashboard
   

   # service wazuh-dashboard restart