search

wazuh / wazuh-packages

Wazuh - Tools for packages creation
https://wazuh.com
GNU General Public License v2.0
105 stars 97 forks source link

Error on health-check: No template found for the selected index-pattern title [wazuh-alerts-*] #2941

Closed CarlosALgit closed 6 months ago

CarlosALgit commented 6 months ago
Wazuh version Install type Action performed Platform
4.8.0-rc1 Offline Installation Install Amazon Linux 2

Related issue: https://github.com/wazuh/wazuh/issues/23251

Description

I've been testing the 4.8.0-rc1 Installation Assistant and when trying to access the Wazuh web interface on the instance I've installed Wazuh via the Offline Installation Assistant I get the following error:

INFO: Index pattern id in cookie: yes [wazuh-alerts-*]
INFO: Getting list of valid index patterns...
INFO: Valid index patterns found: 1
INFO: Found default index pattern with title [wazuh-alerts-*]: yes
INFO: Checking the app default pattern exists: id [wazuh-alerts-*]...
INFO: Default pattern with id [wazuh-alerts-*] exists: yes
ACTION: Default pattern id [wazuh-alerts-*] set as default index pattern
INFO: Checking the index pattern id [wazuh-alerts-*] exists...
INFO: Index pattern id exists [wazuh-alerts-*]: yes
INFO: Index pattern id in cookie: yes [wazuh-alerts-*]
INFO: Checking if the index pattern id [wazuh-alerts-*] exists...
INFO: Index pattern id [wazuh-alerts-*] found: yes title [wazuh-alerts-*]
INFO: Checking if exists a template compatible with the index pattern title [wazuh-alerts-*]
INFO: Template found for the selected index-pattern title [wazuh-alerts-*]: no
ERROR: No template found for the selected index-pattern title [wazuh-alerts-*]
INFO: Index pattern id in cookie: [wazuh-alerts-*]
INFO: Getting index pattern data [wazuh-alerts-*]...
INFO: Index pattern data found: [yes]
INFO: Refreshing index pattern fields: title [wazuh-alerts-*], id [wazuh-alerts-*]...
ACTION: Refreshed index pattern fields: title [wazuh-alerts-*], id [wazuh-alerts-*]
INFO: Getting settings...
INFO: Check Wazuh dashboard setting [timeline:max_buckets]: 200000
INFO: App setting [timeline:max_buckets]: 200000
INFO: Settings mismatch [timeline:max_buckets]: no
INFO: Getting settings...
INFO: Check Wazuh dashboard setting [metaFields]: ["_source","_index"]
INFO: App setting [metaFields]: ["_source","_index"]
INFO: Settings mismatch [metaFields]: no
INFO: Getting settings...
INFO: Check Wazuh dashboard setting [timepicker:timeDefaults]: {"from":"now-24h","to":"now"}
INFO: App setting [timepicker:timeDefaults]: "{\"from\":\"now-24h\",\"to\":\"now\"}"
INFO: Settings mismatch [timepicker:timeDefaults]: no

Captura desde 2024-05-07 14-28-09

Captura desde 2024-05-07 14-28-09

Information

The steps I've been taking to install Wazuh on this instance are on the related issue https://github.com/wazuh/wazuh/issues/23251 --> Install Logs --> Amazon Linux 2 - Offline --> Logs on the console

davidcr01 commented 6 months ago

Update Report

I could not reproduce the problem. I followed the steps given in the documentation: https://documentation-dev.wazuh.com/v4.8.0-rc1/deployment-options/offline-installation.html

Installation log ```console [root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && bash ./wazuh-install.sh -dw rpm 07/05/2024 14:56:15 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0 07/05/2024 14:56:15 INFO: Verbose logging redirected to /var/log/wazuh-install.log 07/05/2024 14:56:17 INFO: Verifying that your system meets the recommended minimum hardware requirements. 07/05/2024 14:56:23 INFO: --- Download Packages --- 07/05/2024 14:56:23 INFO: Starting Wazuh packages download. 07/05/2024 14:56:23 INFO: Downloading Wazuh rpm packages for x86_64. 07/05/2024 14:56:28 INFO: The manager package was downloaded. 07/05/2024 14:56:29 INFO: The filebeat package was downloaded. 07/05/2024 14:56:39 INFO: The indexer package was downloaded. 07/05/2024 14:56:43 INFO: The dashboard package was downloaded. 07/05/2024 14:56:43 INFO: The packages are in wazuh-offline/wazuh-packages 07/05/2024 14:56:43 INFO: Downloading configuration files and assets. 07/05/2024 14:56:43 INFO: The resource https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH was downloaded. 07/05/2024 14:56:43 INFO: The resource https://packages-dev.wazuh.com/4.8/tpl/wazuh/filebeat/filebeat.yml was downloaded. 07/05/2024 14:56:44 INFO: The resource https://raw.githubusercontent.com/wazuh/wazuh/4.8.0/extensions/elasticsearch/7.x/wazuh-template.json was downloaded. 07/05/2024 14:56:44 INFO: The resource https://packages-dev.wazuh.com/pre-release/filebeat/wazuh-filebeat-0.4.tar.gz was downloaded. 07/05/2024 14:56:44 INFO: The configuration files and assets are in wazuh-offline.tar.gz 07/05/2024 14:57:58 INFO: You can follow the installation guide here https://documentation.wazuh.com/current/deployment-options/offline-installation.html [root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/config.yml [root@ip-172-31-34-52 ec2-user]# sed -i -e '0,// s//127.0.0.1/' config.yml [root@ip-172-31-34-52 ec2-user]# sed -i -e '0,// s//127.0.0.1/' config.yml [root@ip-172-31-34-52 ec2-user]# sed -i -e '0,// s//127.0.0.1/' config.yml [root@ip-172-31-34-52 ec2-user]# cat config.yml nodes: # Wazuh indexer nodes indexer: - name: node-1 ip: "127.0.0.1" #- name: node-2 # ip: "" #- name: node-3 # ip: "" # Wazuh server nodes # If there is more than one Wazuh server # node, each one must have a node_type server: - name: wazuh-1 ip: "127.0.0.1" # node_type: master #- name: wazuh-2 # ip: "" # node_type: worker #- name: wazuh-3 # ip: "" # node_type: worker # Wazuh dashboard nodes dashboard: - name: dashboard ip: "127.0.0.1"[root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-certs-tool.sh [root@ip-172-31-34-52 ec2-user]# chmod 744 wazuh-certs-tool.sh [root@ip-172-31-34-52 ec2-user]# ./wazuh-certs-tool.sh --all 07/05/2024 14:59:01 INFO: Generating the root certificate. 07/05/2024 14:59:01 INFO: Generating Admin certificates. 07/05/2024 14:59:01 INFO: Admin certificates created. 07/05/2024 14:59:01 INFO: Generating Wazuh indexer certificates. 07/05/2024 14:59:01 INFO: Wazuh indexer certificates created. 07/05/2024 14:59:01 INFO: Generating Filebeat certificates. 07/05/2024 14:59:01 INFO: Wazuh Filebeat certificates created. 07/05/2024 14:59:01 INFO: Generating Wazuh dashboard certificates. 07/05/2024 14:59:01 INFO: Wazuh dashboard certificates created. [root@ip-172-31-34-52 ec2-user]# tar xf wazuh-offline.tar.gz [root@ip-172-31-34-52 ec2-user]# ls -l wazuh-offline/wazuh-packages/ total 1363696 -rw------- 1 root root 21808122 May 7 14:56 filebeat-oss-7.10.2-x86_64.rpm -rw------- 1 root root 286053840 May 7 14:56 wazuh-dashboard-4.8.0-1.x86_64.rpm -rw------- 1 root root 778825404 May 7 14:56 wazuh-indexer-4.8.0-1.x86_64.rpm -rw------- 1 root root 309730892 May 7 14:56 wazuh-manager-4.8.0-1.x86_64.rpm [root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH [root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-indexer*.rpm Preparing... ################################# [100%] Updating / installing... 1:wazuh-indexer-4.8.0-1 ################################# [100%] Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore [root@ip-172-31-34-52 ec2-user]# NODE_NAME=node-1 [root@ip-172-31-34-52 ec2-user]# mkdir /etc/wazuh-indexer/certs [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem [root@ip-172-31-34-52 ec2-user]# mv wazuh-certificates/admin-key.pem /etc/wazuh-indexer/certs/ [root@ip-172-31-34-52 ec2-user]# mv wazuh-certificates/admin.pem /etc/wazuh-indexer/certs/ [root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/wazuh-indexer/certs/ [root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/wazuh-indexer/certs [root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/wazuh-indexer/certs/* [root@ip-172-31-34-52 ec2-user]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs [root@ip-172-31-34-52 ec2-user]# nano /etc/wazuh-indexer/opensearch.yml [root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload [root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-indexer Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service. [root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-indexer [root@ip-172-31-34-52 ec2-user]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh ************************************************************************** ** This tool will be deprecated in the next major release of OpenSearch ** ** https://github.com/opensearch-project/security/issues/1755 ** ************************************************************************** Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.10.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index does not exists, attempt to create it ... done (0-all replicas) Populate config from /etc/wazuh-indexer/opensearch-security/ Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml SUCC: Configuration for 'roles' created or updated Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml SUCC: Configuration for 'rolesmapping' created or updated Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml SUCC: Configuration for 'internalusers' created or updated Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml SUCC: Configuration for 'actiongroups' created or updated Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml SUCC: Configuration for 'tenants' created or updated Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml SUCC: Configuration for 'nodesdn' created or updated Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml SUCC: Configuration for 'whitelist' created or updated Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml SUCC: Configuration for 'audit' created or updated Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml SUCC: Configuration for 'allowlist' created or updated SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null Done with success [root@ip-172-31-34-52 ec2-user]# curl -XGET https://127.0.0.1:9200 -u admin:admin -k { "name" : "node-1", "cluster_name" : "wazuh-cluster", "cluster_uuid" : "_duT-TOWQMq4BjLtIYV6ZQ", "version" : { "number" : "7.10.2", "build_type" : "rpm", "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03", "build_date" : "2023-09-20T23:54:29.889267151Z", "build_snapshot" : false, "lucene_version" : "9.7.0", "minimum_wire_compatibility_version" : "7.10.0", "minimum_index_compatibility_version" : "7.0.0" }, "tagline" : "The OpenSearch Project: https://opensearch.org/" } [root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH [root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-manager*.rpm Preparing... ################################# [100%] Updating / installing... 1:wazuh-manager-4.8.0-1 ################################# [100%] [root@ip-172-31-34-52 ec2-user]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v admin [root@ip-172-31-34-52 ec2-user]# /var/ossec/bin/wazuh-keystore -f indexer -k password -v admin [root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload [root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-manager Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service. [root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-manager [root@ip-172-31-34-52 ec2-user]# systemctl status wazuh-manager ● wazuh-manager.service - Wazuh manager Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2024-05-07 15:04:21 UTC; 5s ago Process: 8460 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS) CGroup: /system.slice/wazuh-manager.service ├─8519 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py ├─8560 /var/ossec/bin/wazuh-authd ├─8577 /var/ossec/bin/wazuh-db ├─8604 /var/ossec/bin/wazuh-execd ├─8606 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py ├─8609 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py ├─8612 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py ├─8628 /var/ossec/bin/wazuh-analysisd ├─8640 /var/ossec/bin/wazuh-syscheckd ├─8688 /var/ossec/bin/wazuh-remoted ├─8725 /var/ossec/bin/wazuh-logcollector ├─8745 /var/ossec/bin/wazuh-monitord ├─8766 /var/ossec/bin/wazuh-modulesd ├─9077 sh -c yum check-updates --security | grep "No packages" ├─9079 /usr/bin/python /usr/bin/yum check-updates --security └─9080 grep No packages May 07 15:04:14 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-syscheckd... May 07 15:04:15 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-remoted... May 07 15:04:16 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-logcollector... May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-monitord... May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: 2024/05/07 15:04:18 wazuh-modulesd:router: INFO: Load...le. May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: 2024/05/07 15:04:18 wazuh-modulesd:content_manager: I...le. May 07 15:04:19 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-modulesd... May 07 15:04:21 ip-172-31-34-52.ec2.internal env[8460]: Completed. May 07 15:04:21 ip-172-31-34-52.ec2.internal systemd[1]: Started Wazuh manager. May 07 15:04:21 ip-172-31-34-52.ec2.internal crontab[9025]: (root) LIST (root) Hint: Some lines were ellipsized, use -l to show in full. [root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/filebeat*.rpm Preparing... ################################# [100%] Updating / installing... 1:filebeat-7.10.2-1 ################################# [100%] [root@ip-172-31-34-52 ec2-user]# cp ./wazuh-offline/wazuh-files/filebeat.yml /etc/filebeat/ &&\ > cp ./wazuh-offline/wazuh-files/wazuh-template.json /etc/filebeat/ &&\ > chmod go+r /etc/filebeat/wazuh-template.json cp: overwrite ‘/etc/filebeat/filebeat.yml’? y [root@ip-172-31-34-52 ec2-user]# nano /etc/filebeat/filebeat.yml [root@ip-172-31-34-52 ec2-user]# filebeat keystore create Created filebeat keystore [root@ip-172-31-34-52 ec2-user]# echo admin | filebeat keystore add username --stdin --force Successfully updated the keystore [root@ip-172-31-34-52 ec2-user]# echo admin | filebeat keystore add password --stdin --force Successfully updated the keystore [root@ip-172-31-34-52 ec2-user]# tar -xzf ./wazuh-offline/wazuh-files/wazuh-filebeat-0.4.tar.gz -C /usr/share/filebeat/module [root@ip-172-31-34-52 ec2-user]# ls wazuh-offline/wazuh-files/wazuh- wazuh-filebeat-0.4.tar.gz wazuh-template.json [root@ip-172-31-34-52 ec2-user]# NODE_NAME=wazuh-1 [root@ip-172-31-34-52 ec2-user]# mkdir /etc/filebeat/certs [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem [root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/filebeat/certs/ [root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/filebeat/certs [root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/filebeat/certs/* [root@ip-172-31-34-52 ec2-user]# chown -R root:root /etc/filebeat/certs [root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload [root@ip-172-31-34-52 ec2-user]# systemctl enable filebeat Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service. [root@ip-172-31-34-52 ec2-user]# systemctl start filebeat [root@ip-172-31-34-52 ec2-user]# filebeat test output elasticsearch: https://127.0.0.1:9200... parse url... OK connection... parse host... OK dns lookup... OK addresses: 127.0.0.1 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.3 dial up... OK talk to server... OK version: 7.10.2 [root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH [root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-dashboard*.rpm Preparing... ################################# [100%] Updating / installing... 1:wazuh-dashboard-4.8.0-1 ################################# [100%] [root@ip-172-31-34-52 ec2-user]# NODE_NAME=dashboard [root@ip-172-31-34-52 ec2-user]# mkdir /etc/wazuh-dashboard/certs [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem [root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem [root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/ [root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/wazuh-dashboard/certs [root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/wazuh-dashboard/certs/* [root@ip-172-31-34-52 ec2-user]# chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs [root@ip-172-31-34-52 ec2-user]# nano /etc/wazuh-dashboard/opensearch_dashboards.yml [root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload [root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-dashboard Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service to /etc/systemd/system/wazuh-dashboard.service. [root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-dashboard [root@ip-172-31-34-52 ec2-user]# nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml [root@ip-172-31-34-52 ec2-user]# nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml [root@ip-172-31-34-52 ec2-user]# systemctl status wazuh-dashboard ● wazuh-dashboard.service - wazuh-dashboard Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2024-05-07 15:10:29 UTC; 41s ago Main PID: 6938 (node) CGroup: /system.slice/wazuh-dashboard.service └─6938 /usr/share/wazuh-dashboard/node/fallback/bin/node --no-warnings --max-http-header-size=65536 -... May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-...pm May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:41 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} May 07 15:10:42 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."} Hint: Some lines were ellipsized, use -l to show in full. ```

Screenshot from 2024-05-07 17-12-29

image

I recommend to follow the steps given in the documentation and log into the Wazuh dashboard in a incognito window.