wazuh-alerts-* Pattern is not found in Kibana 5.6.2 about wazuh-dashboard-plugins

[havidarou]

Hi @Mugen1991 this is happening because you need to set up wazuh-alerts-* as your default index-pattern, instead of logstash-*

To set it as default, select it and click in the star icon on the right part of the screen.

Regards.

[Mugen1991]

Hi @havidarou,
thanks for your quick reply. Sadly this did not really fix the problem,
Now it doesnt use logstash-* but some cryptic pattern.

[Mugen1991]

The funny thing is: When I go on "discover" under the wazuh tab, It even shows me the documents

[havidarou]

Maybe the .kibana index is somehow corrupted.

Stop Kibana:

systemctl stop kibana

You can create a backup of .kibana (just in case) and then delete it:

curl -XDELETE url_to_elastic:9200/.kibana

Then delete the .wazuh index (you'll have to reintroduce the credentials afterwards):

curl -XDELETE url_to_elastic:9200/.wazuh

And then start Kibana again:

systemctl start kibana

Regards.

[JuanjiJG]

It's been more than a month since the last response to this issue, so we proceed to close it.

Regards.