# Error Parsing Wazuh data

**URL:** <https://community.graylog.org/t/error-parsing-wazuh-data/33043>\
**Category:** Graylog Central (peer support)\
**Created:** [July 19, 2024, 7:07pm UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043 "2024-07-19T19:07:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AlexTratisky](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@AlexTratisky](https://community.graylog.org/u/AlexTratisky)\
**Post date:** [July 19, 2024, 7:07pm UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043/1 "2024-07-19T19:07:12Z")

</div>

Hello,

I have successfully integrated wazuh with graylog so that wazuh sends json logs to graylog using fluent bit . the integration is OK and i can see traffic flowing into graylog. the main issue i am facing is that the logs are not being seen in the search bar.

Graylog is sending the logs to wazuh indexer over https and i can see that it created some indices on wazuh indexer. so i dont think i have an integration issue here.

I understand that wazuh 4.8.1 uses opensearch (the indexer) and not elasticsearch. should i install any specific plugins to be able to parse those logs correctly?

Appreciate some help to troubleshoot this issue.

i am using:  
ii graylog-5.2-repository 1-2 all Package to install Graylog 5.2 GPG key and repository  
ii graylog-server 5.2.9-1 amd64 Graylog server

Please find below sa snapshot

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/1/9/1966395f33ceb71131c446a673b688494ff54b7b.png)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 19, 2024, 10:01pm UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043/2 "2024-07-19T22:01:01Z")

</div>

Hey @AlexTratisky

in your opensearch.yml file you may need to add this and restart your service.

```auto
compatibility.override_main_response_version: true

```

Found here.

> [@Elasticsearch exception reason=key \[types\] is not supported in the metadata section](https://community.graylog.org/t/elasticsearch-exception-reason-key-types-is-not-supported-in-the-metadata-section/27468):
>
> Hi, I setup Graylog v5 with Opensearch v2.0.1 and MongoDB v5.0.14 on Ubuntu 20.04.5 LTS following the official documentation. I’m getting the following error when I go to the search tab: Here is my config file: ############################ # GRAYLOG CONFIGURATION FILE ############################ # # This is the Graylog configuration file. The file has to use ISO 8859-1/Latin-1 character encoding. # Characters that cannot be directly represented in this encoding can be written using…

---

<div class="post-metadata">

**Author:** ![AlexTratisky](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@AlexTratisky](https://community.graylog.org/u/AlexTratisky)\
**Post date:** [July 20, 2024, 2:19am UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043/3 "2024-07-20T02:19:42Z")

</div>

Thank you @gsmith that does the job

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 20, 2024, 2:43am UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043/4 "2024-07-20T02:43:11Z")

</div>

Hey @AlexTratisky

Wazuh with Graylog has some issues. It best to use Elasticsearch and/or OpenSearch. I run a Wazuh server and OpenSearch server. What I found out Wazuh uses ossec in the back end. I haven’t had it working correctly so I stayed with just OpenSearch. Perhaps try a different input type, just an idea.

> [@AlexTratisky](#):
>
> ` /var/ossec/logs/alerts/alerts.json`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 3, 2024, 2:43am UTC](https://community.graylog.org/t/error-parsing-wazuh-data/33043/5 "2024-08-03T02:43:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.