Skip to content

Fix compatibility index pattern check #7825

@Desvelao

Description

@Desvelao
Wazuh Rev Browser
5.0 xyzw Chrome, Firefox, Safari, etc

Description
The dashboard has some compatibility problems with the other components and cause the index patterns can not be correctly created.

  • The monitoring indices are: wazuh-monitoring
  • The statistics indices are: wazuh-statistics
  • The timefield of alerts data is @timestamp instead of timestamp

Tasks

  • Change monitoring pattern to wazuh-alerts*
  • Change monitoring pattern to wazuh-monitoring*
  • Change monitoring pattern to wazuh-statistics*
  • Replace the check of timefield in the alerts data to @timestatmp
  • Remove the check related to wazuh template for the alerts data.
  • Create index patterns for the wazuh-events indices (wazuh-events-v5-system-activity, wazuh-events-v5-security, wazuh-events-v5-other, wazuh-events-v5-network-activity, wazuh-events-v5-cloud-services, wazuh-events-v5-applications, wazuh-events-v5-access-management, wazuh-events-v5-cloud-services-aws, wazuh-events-v5-cloud-services-azure, wazuh-events-v5-cloud-services-gcp
  • Create index pattern for the wazuh-archives indices

Additional context

Related errrors:

Error initilizating index pattern with ID [wazuh-alerts-*]: index pattern with ID [wazuh-alerts-*] could not be created due to: time field name was not found [timestamp] in the fields. This could indicate the collection is disabled or there is a problem in the data collection or ingestion.

Related issues:

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions