Wazuh 4.x index management

Wazuh 4.x index management

You can achieve this by setting the policy id in the /etc/filebeat/wazuh-template.json file (on the Wazuh nodes) and then reloading the template. For example, let's say that you have created your ISM policy on Elasticsearch with id wazuh-index-state-policy,

Edit the wazuh-template.json file.

Add the line "opendistro.index_state_management.policy_id": "wazuh-index-state-policy" inside the settingsobject:
            
"opendistro" : {
          "index_state_management" : {
            "policy_id" : "hot_warm_delete_workflow"
          }
        },

Reload the template into Elasticsearch: filebeat setup --index-management

You can check that the template was successfully loaded going into Kibana -> DevTools and executing: GET /_template/wazuh

Let me know if this helped!

More info:
https://wazuh.com/blog/wazuh-index-management/ (Check the paragraph For this to be applied to indices created in the future you must change the index template to include this policy. Run the following commands on the Wazuh Manager's command line:)
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html#load-template-manually