search

wazuh / wazuh-docker

Wazuh - Docker containers
https://wazuh.com
Other
661 stars 361 forks source link

this cluster currently has [1000]/[1000] maximum shards open #1437

Open dp466 opened 2 months ago

dp466 commented 2 months ago

Hi All!

ive seen this issue on the standard deployment but not via Docker

i get the following error from the Dashboard container: An OpenSearch Dashboards keystore already exists. Overwrite? [y/N] Created OpenSearch Dashboards keystore in /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore FATAL {"error":{"root_cause":[{"type":"validation_exception","reason":"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open;"}],"type":"validation_exception","reason":"Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open;"},"status":400}

i dont know how to fix that issue

soundmountain commented 3 days ago

As a temporary fix you can increase the amount of shards. exec into to the shell of wazuh-indexer and then run this command (change user and pw accordingly): curl -u admin:SecretPassword -X PUT https://localhost:9200/_cluster/settings -H "Content-Type: application/json" -d '{ "persistent": { "cluster.max_shards_per_node": "3000" } }' -k after that i suggest you look at the documentation https://documentation.wazuh.com/current/user-manual/wazuh-indexer/index-life-management.html and configure a retention policy and apply it to your indices otherwise the same problem will occur later down the road once 3000 shards are open.