1. Describe your incident: In trying to set up Graylog to connect to Wazuh Indexer, I am unable to get it to connect and create new indexes. I receive this error during preflight when launching the docker container for graylog: ERROR: org.graylog2.storage.versionprobe.VersionProbe - Unable to retr…

Hey @Sam_Gunn , The Graylog node is failing to reach 10.10.1.60 on port 9200, are you certain that networking between the Graylog node and your Opensearch is correctly set up?

Thank you for replying. I do sometimes hate yaml files. Turned out you’re right - the Wazuh indexer was using the localhost instead of it’s Network IP and that prevented connections across the network. Now graylog is giving this error: Unable to retrieve version from indexer node: (certificate_unk…

Thanks! I actually found that last night and it got me on the right track. Now I am getting this error, which I believe suggests a problem on the wazuh side, right? 2026-02-27 14:13:29,183 ERROR: org.graylog2.storage.versionprobe.VersionProbe - Unable to retrieve version from indexer node 10.10.1.6…

By looking through more logs, I discovered that graylog is not sending the authorization header. This is the error i get on the wazuh side: [2026-02-27T17:21:53,426][WARN ][o.o.s.a.BackendRegistry ] [node-1] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic' I am trying to figure o…

In this instance what is the indexer, are you using Graylog Data Node or Opensearch - if Opensearch which version? If you could post the docker conf for OS that would help give some context.

Sorry for not clarifying. Wazuh indexer uses opensearch. Looks like version 2.19.4. Here is my docker config for Graylog. Wazuh is a standalone install on a VM. # Graylog: https://hub.docker.com/r/graylog/graylog-enterprise graylog: hostname: "server" image: "${GRAYLOG_IMAGE:-graylog/gr…

Graylog currently supports 2.19.3 so you might experience some issues when you finally get connected. Has security been implemented on the Opensearch cluster and did you generate a username and password? It would be the same as the one used for Wazuh to connect to OS, It could also be a JWT token.

Yes, the indexer has security, and I’ve setup the keystore and credentials in my graylog environment: GRAYLOG_ELASTICSEARCH_HOSTS: "https://10.10.1.60:9200" GRAYLOG_ELASTICSEARCH_USERNAME: "graylog" GRAYLOG_ELASTICSEARCH_PASSWORD: "password" GRAYLOG_SERVER_JAVA_OPTS: "-Djavax.net…

Hey @Sam_Gunn , Try with the below and drop the GRAYLOG_ELASTICSEARCH_USERNAME and GRAYLOG_ELASTICSEARCH_PASSWORD options. GRAYLOG_ELASTICSEARCH_HOSTS = https://graylog:password@10.10.1.60:9200

Graylog can't connect to Wazuh Indexer

Graylog Central (peer support)

Wine_Merchant February 27, 2026, 8:50am 4

Check out this chain, it links out to a guide on implementing certs and some specifics in the last comment on how that is achieved within docker.

Topic		Replies	Views
Graylog 5.0 with Wazuh Indexer Graylog Central (peer support)	11	9470	May 23, 2023
Integrating wazuh indexer with Graylog Graylog Central (peer support)	9	6439	November 14, 2022
Problem in Connection Between Graylog and Wazuh Indexer (Opensearch Fork) Graylog Central (peer support)	3	1571	February 20, 2024
Trying to connect graylog to Wazuh Indexer getting Errors Graylog Central (peer support) access-specific-log-	1	857	March 16, 2023
Connecting Graylog to Wazuh Graylog Central (peer support)	4	3794	October 2, 2024

Graylog can't connect to Wazuh Indexer

Related topics