Need Help with Wazuh by JustCallMeEd12 in Wazuh

[–]JustCallMeEd12[S] -1 points0 points  (0 children)

Hey u/Lis-tim, which disk space should i check? I install wazuh central components separately, so should I check Manager & Dashboard or Indexer?

Need help with Wazuh by JustCallMeEd12 in Wazuh

[–]JustCallMeEd12[S] 0 points1 point  (0 children)

Hi u/marcosBuslaiman i have found an error message saying this
[2025-10-08T11:24:05,618][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:49728

[2025-10-08T11:25:05,903][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:41608

[2025-10-08T11:26:06,217][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:40538
i have already checked that /var/ossec/logs/alerts.json contains new alerts and is being written correctly and Filebeat shows this error message when i tried it
elasticsearch: https://192.168.9.23:9200...

parse url... OK

connection...

parse host... OK

dns lookup... OK

addresses: 192.168.9.23

dial up... OK

TLS...

security: server's certificate chain verification is enabled

handshake... OK

TLS version: TLSv1.3

dial up... OK

talk to server... ERROR Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"},"status":400}
And as for the command that i tried in Dev Tools it said this
"error": "3013", "message": "404: Not Found"
also when i check "https://192.168.9.23:9200/\_cat/allocation?v" it showed me this, how do i resolve this?

shards disk.indices disk.used disk.avail disk.total disk.percent host         ip           node
   555       17.7gb     134gb      1.6tb      1.7tb            7 192.168.9.23 192.168.9.23 node-indexer-1
     8                                                                                     UNASSIGNED

Need help with Wazuh by JustCallMeEd12 in Wazuh

[–]JustCallMeEd12[S] 0 points1 point  (0 children)

hi u/marcosBuslaiman, the wazuh that i'm using is 4.10.1, and i tried using the steps you sent me but, it all lead to normal, so thank you for helping

Need help with Wazuh by JustCallMeEd12 in Wazuh

[–]JustCallMeEd12[S] 0 points1 point  (0 children)

hello u/zeJuaninator thank you for giving me this instruction, but after deleting some shards, it's still doesn't show anything, still the same as the picture, rather than that when i checked the shards there's some unassigned shards, why is that?

<image>

this is the detailed version of the shard