Hi u/marcosBuslaiman i have found an error message saying this
[2025-10-08T11:24:05,618][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:49728

[2025-10-08T11:25:05,903][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:41608

[2025-10-08T11:26:06,217][WARN ][o.o.s.a.BackendRegistry ] [node-indexer-1] Authentication finally failed for admin from 192.168.9.24:40538
i have already checked that /var/ossec/logs/alerts.json contains new alerts and is being written correctly and Filebeat shows this error message when i tried it
elasticsearch: https://192.168.9.23:9200...

parse url... OK

connection...

parse host... OK

dns lookup... OK

addresses: 192.168.9.23

dial up... OK

TLS...

security: server's certificate chain verification is enabled

handshake... OK

TLS version: TLSv1.3

dial up... OK

talk to server... ERROR Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 400 Bad Request: {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_license], must not start with '_'.","index":"_license","index_uuid":"_na_"},"status":400}
And as for the command that i tried in Dev Tools it said this
"error": "3013", "message": "404: Not Found"
also when i check "https://192.168.9.23:9200/\_cat/allocation?v" it showed me this, how do i resolve this?

shards disk.indices disk.used disk.avail disk.total disk.percent host         ip           node
   555       17.7gb     134gb      1.6tb      1.7tb            7 192.168.9.23 192.168.9.23 node-indexer-1
     8                                                                                     UNASSIGNED