Error Parsing Wazuh data

Graylog Central (peer support)
1

Hello,

I have successfully integrated wazuh with graylog so that wazuh sends json logs to graylog using fluent bit . the integration is OK and i can see traffic flowing into graylog. the main issue i am facing is that the logs are not being seen in the search bar.

Graylog is sending the logs to wazuh indexer over https and i can see that it created some indices on wazuh indexer. so i dont think i have an integration issue here.

I understand that wazuh 4.8.1 uses opensearch (the indexer) and not elasticsearch. should i install any specific plugins to be able to parse those logs correctly?

Appreciate some help to troubleshoot this issue.

i am using:
ii graylog-5.2-repository 1-2 all Package to install Graylog 5.2 GPG key and repository
ii graylog-server 5.2.9-1 amd64 Graylog server

Please find below sa snapshot

image
image2764×1712 256 KB

2

Hey @AlexTratisky

in your opensearch.yml file you may need to add this and restart your service.

compatibility.override_main_response_version: true

Found here.

1 Like
3

Thank you @gsmith that does the job

4

Hey @AlexTratisky

Wazuh with Graylog has some issues. It best to use Elasticsearch and/or OpenSearch. I run a Wazuh server and OpenSearch server. What I found out Wazuh uses ossec in the back end. I haven’t had it working correctly so I stayed with just OpenSearch. Perhaps try a different input type, just an idea.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.