Troubleshooting Guide - Wazuh Dashboard Plugins

This guide provides solutions to common issues you may encounter with the Wazuh dashboard, along with diagnostic procedures and troubleshooting steps.

Common Error Messages

Filter Could Not Be Created

Error Message:

Filter could not be created because no server API is selected. Make sure a server API is available and choose one in the selector.

Description: The filter related to the selected server API (cluster.name in the alerts case or wazuh.cluster.name in the inventories data) cannot be created because the required information is not available. The required data to create the filter is stored in the clusterInfo cookie in the client browser. Cause: The cookie is not set or the server API information could not be obtained. Solutions:

Verify a server API is selected in the selector of the dashboard header
Ensure the server API is online and reachable:

# Test connectivity
ping <SERVER_API_HOST>

# Test API endpoint
curl -k -u <USERNAME>:<PASSWORD> https://<SERVER_API_HOST>:55000/

Check the server API configuration in opensearch_dashboards.yml:

grep -A 10 "wazuh_core.hosts:" /etc/wazuh-dashboard/opensearch_dashboards.yml

Confirm the clusterInfo cookie is set in the browser:
- Open browser developer tools (F12)
- Navigate to Application/Storage > Cookies
- Check for clusterInfo cookie
Clear browser cookies and cache, then refresh and reselect the API

Index Pattern Not Found

Error Message:

Index pattern [id: index_pattern_id] not found.

Description: The expected index pattern used as a data source for a view or panel could not be found. Cause: The expected index pattern does not exist, or there are no matching indices. Solutions:

Check if the index pattern exists:
- Navigate to Dashboard Management > Index Patterns
- Look for the specified index pattern ID or title
Create the index pattern if missing:
- Go to Dashboard Management > Index Patterns
- Click Create index pattern
- Enter the pattern name (e.g., wazuh-events*)
- Select the time field (timestamp)
- Click Create
Verify matching indices exist:

# Check for indices
curl -X GET "https://localhost:9200/_cat/indices/wazuh-*?v" -u admin:admin -k

If no matching indices exist, check:
- Data collection is enabled on agents
- Filebeat/Logstash is running and configured correctly
- Indexer is receiving data
- Review server and indexer logs for ingestion issues
Run Health Check to recreate default index patterns:
- Navigate to Management > Health Check
- Click Check to regenerate missing resources

Server API Not Available

Error Message:

The server API is not available. Check the connection, ensure the service is running, and verify the API host configuration.

Description: The dashboard cannot connect with the server API host. Possible Causes:

Server API host is not reachable from the dashboard host
Network problem (firewall, routing issue)
Server API is down or stopped
Wrong server API host configuration (URL, port, or credentials)

Solutions:

Ensure the server API is running:

sudo systemctl status wazuh-manager

# If stopped, start it
sudo systemctl start wazuh-manager

Verify API is responding:

curl -k -u <USERNAME>:<PASSWORD> https://<SERVER_API_HOST>:55000/

Check network connectivity:

# Test basic connectivity
ping <SERVER_API_HOST>

# Test port connectivity
telnet <SERVER_API_HOST> 55000

# Or use nc
nc -zv <SERVER_API_HOST> 55000

Review firewall rules:

# RHEL/CentOS
sudo firewall-cmd --list-all
sudo firewall-cmd --add-port=55000/tcp --permanent
sudo firewall-cmd --reload

# Ubuntu
sudo ufw status
sudo ufw allow 55000/tcp

Verify API configuration in dashboard:

grep -A 10 "wazuh_core.hosts:" /etc/wazuh-dashboard/opensearch_dashboards.yml

Check API credentials:

# On the manager, verify user exists
sudo /var/ossec/bin/wazuh-authd -P

Review API logs on the manager:

sudo tail -f /var/ossec/logs/api.log

No Server API Selected

Error Message:

No server API selected. Please choose one from the server API selector.

Description: The server API host is not selected. The selection is stored in the currentApi cookie in the browser. Cause: The currentApi cookie is not set or has a falsy value. Solutions:

Select a server API using the selector in the dashboard header
Verify server API is configured:
- Navigate to Server APIs management
- Ensure at least one API is configured and reachable
Check browser cookies:
- Open developer tools (F12)
- Navigate to Application/Storage > Cookies
- Verify currentApi cookie exists
Clear browser cookies and cache, then refresh and select an API
Verify API configuration in opensearch_dashboards.yml:

grep -A 10 "wazuh_core.hosts:" /etc/wazuh-dashboard/opensearch_dashboards.yml

Connection Issues

Dashboard Cannot Connect to Indexer

Symptoms:

Dashboard fails to start
Error: “Unable to connect to OpenSearch”
Saved objects not loading

Solutions:

Verify indexer is running:

sudo systemctl status wazuh-indexer

# Check indexer health
curl -X GET "https://localhost:9200/_cluster/health?pretty" -u admin:admin -k

Check indexer connection settings in opensearch_dashboards.yml:

opensearch.hosts: ['https://localhost:9200']
opensearch.username: 'admin'
opensearch.password: 'admin'

Verify SSL certificates:

# Check certificate files exist
ls -la /etc/wazuh-dashboard/certs/

# Test SSL connection
openssl s_client -connect localhost:9200 -CAfile /etc/wazuh-dashboard/certs/root-ca.pem

Review dashboard logs:

sudo tail -100 /var/log/wazuh-dashboard/opensearch_dashboards.log | grep -i error

Check network connectivity between dashboard and indexer

Dashboard Cannot Connect to Wazuh API

Symptoms:

“Wazuh API is not reachable” message
Agent information not loading
Health check fails on API connection

Solutions:

Verify manager is running:

sudo systemctl status wazuh-manager

Test API manually:

curl -k -u wazuh-wui:wazuh-wui https://localhost:55000/

Check API configuration in dashboard:

grep -A 10 "wazuh_core.hosts:" /etc/wazuh-dashboard/opensearch_dashboards.yml

Verify API credentials:

# Check API user
sudo cat /usr/share/wazuh-dashboard/data/wazuh/config/wazuh-api.yml

Check firewall rules (see Server API Not Available section)
Review API logs:

sudo tail -f /var/ossec/logs/api.log

Service Issues

Dashboard Service Fails to Start

Symptoms:

Service fails immediately after starting
Service shows as “failed” status

Solutions:

Check service status:

sudo systemctl status wazuh-dashboard

Review service logs:

sudo journalctl -u wazuh-dashboard -n 100 --no-pager

Check dashboard logs:

sudo tail -100 /var/log/wazuh-dashboard/opensearch_dashboards.log

Verify configuration syntax:

# Check for syntax errors
sudo grep -v "^#" /etc/wazuh-dashboard/opensearch_dashboards.yml | grep -v "^$"

Check file permissions:

ls -la /etc/wazuh-dashboard/
ls -la /usr/share/wazuh-dashboard/

Verify port availability:

# Check if port 5601 (or configured port) is available
sudo netstat -tlnp | grep 5601

Check disk space:

df -h

Dashboard Service Crashes

Symptoms:

Service starts but crashes shortly after
Intermittent service failures

Solutions:

Monitor logs in real-time:

sudo tail -f /var/log/wazuh-dashboard/opensearch_dashboards.log

Check for memory issues:

# Check available memory
free -h

# Check for OOM killer
sudo dmesg | grep -i "out of memory"

Increase Node.js memory limit:

sudo systemctl edit wazuh-dashboard

# Add:
[Service]
Environment="NODE_OPTIONS=--max-old-space-size=4096"

Check for plugin conflicts:

sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list

Review system resources:

top
iostat
vmstat

Authentication and Authorization Issues

Symptoms:

Unable to log in to dashboard
“Invalid credentials” errors

Solutions:

Verify credentials with direct indexer access:

curl -X GET "https://localhost:9200/" -u <USERNAME>:<PASSWORD> -k

Check authentication configuration:

grep -i "opensearch.username" /etc/wazuh-dashboard/opensearch_dashboards.yml

Reset user password if needed (on indexer):

# Using OpenSearch security plugin
sudo /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
  -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ \
  -icl -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem \
  -cert /etc/wazuh-indexer/certs/admin.pem \
  -key /etc/wazuh-indexer/certs/admin-key.pem

Check security plugin configuration on indexer

Permission Denied Errors

Symptoms:

Actions fail with permission errors
“Insufficient permissions” messages

Solutions:

Verify user roles in OpenSearch Dashboards:
- Navigate to Security > Roles
- Check user’s assigned roles
Review API user permissions:

# On manager
sudo /var/ossec/bin/wazuh-authd -P

Check RBAC configuration for API access
Verify run_as setting in API configuration:

wazuh_core.hosts:
  default:
    run_as: true  # Should be true for most operations

Data and Display Issues

No Data Displayed

Symptoms:

Dashboards show “No results found”
Event tables are empty
Visualizations show no data

Solutions:

Check time range:
- Expand time range to include expected data
- Verify data exists in the selected time period
Verify indices exist and contain data:

# Check indices
curl -X GET "https://localhost:9200/_cat/indices/wazuh-*?v&s=index" -u admin:admin -k

# Check document count
curl -X GET "https://localhost:9200/wazuh-events*/_count" -u admin:admin -k

Check index pattern:
- Verify correct index pattern is selected
- Refresh index pattern field list
- Recreate index pattern if necessary
Review applied filters:
- Clear all filters and retry
- Check for conflicting filters
Verify agent is sending data:

# On agent
sudo systemctl status wazuh-agent

# Check agent logs
sudo tail -f /var/ossec/logs/ossec.log

Visualizations Not Loading

Symptoms:

Visualizations show errors or fail to render
Dashboards partially load

Solutions:

Check browser console for JavaScript errors (F12)
Clear browser cache and reload
Verify index pattern is valid and has data
Check visualization queries for syntax errors
Review dashboard logs:

sudo tail -100 /var/log/wazuh-dashboard/opensearch_dashboards.log

Regenerate visualizations through Health Check

Saved Objects Missing

Symptoms:

Dashboards or visualizations disappeared
Recently created objects not found

Solutions:

Check tenant/space selection (if using multi-tenancy)
Search for objects:
- Navigate to Dashboard Management > Saved Objects
- Search by name or type
Import from backup if available
Check indexer for saved objects:

curl -X GET "https://localhost:9200/.kibana/_search?pretty" -u admin:admin -k

Run Health Check to recreate default objects

Performance Issues

Slow Dashboard Performance

Symptoms:

Dashboard loads slowly
Queries take a long time
UI is unresponsive

Solutions:

Reduce time range for queries
Apply filters before loading data
Check system resources:

top
free -h
df -h
iostat

Optimize indexer:

# Force merge indices
curl -X POST "https://localhost:9200/wazuh-events*/_forcemerge?max_num_segments=1" -u admin:admin -k

Review slow queries:

tail -f /var/log/wazuh-indexer/wazuh_index_search_slowlog.log

Increase dashboard timeout:

# In opensearch_dashboards.yml
opensearch.requestTimeout: 60000

Clear browser cache and restart browser

See the Performance Tuning guide for comprehensive optimization strategies.

High Memory Usage

Symptoms:

Dashboard consumes excessive memory
System becomes slow
Out of memory errors

Solutions:

Check memory usage:

free -h
ps aux | grep opensearch-dashboards

Increase Node.js memory:

sudo systemctl edit wazuh-dashboard

# Add:
[Service]
Environment="NODE_OPTIONS=--max-old-space-size=4096"

Restart dashboard service:

sudo systemctl restart wazuh-dashboard

Close unnecessary visualizations
Reduce concurrent queries

Plugin Issues

Plugin Errors

Symptoms:

Plugin fails to load
Plugin-specific features not working

Solutions:

List installed plugins:

sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list

Check plugin compatibility:

cat /usr/share/wazuh-dashboard/plugins/wazuh/package.json | grep -A 2 "opensearchDashboards"

Remove and reinstall plugin:

sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin remove wazuh
sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin install <PLUGIN_URL>

Clear optimization cache:

sudo rm -rf /usr/share/wazuh-dashboard/optimize/bundles/*
sudo systemctl restart wazuh-dashboard

Check plugin logs in dashboard logs

Upgrade and Migration Issues

Upgrade Failures

Symptoms:

Package upgrade fails
Service fails after upgrade

Solutions:

Check package manager logs:

# Debian/Ubuntu
sudo cat /var/log/apt/term.log

# RHEL/CentOS
sudo cat /var/log/yum.log

Verify package integrity:

# Debian/Ubuntu
dpkg -l | grep wazuh-dashboard

# RHEL/CentOS
rpm -qa | grep wazuh-dashboard

Review upgrade logs
Check for outdated plugins (see Plugin Issues)
Restore from backup if necessary

See the Upgrade Procedures guide for detailed upgrade steps.

Migration Issues

Symptoms:

Configuration not working after migration
Features missing after migration

Solutions:

Review migration guide for breaking changes
Check configuration migration:
- Verify settings moved from wazuh.yml to opensearch_dashboards.yml
- Update index patterns
- Review deprecated settings
Run Health Check to recreate resources
Import saved objects from backup

See the Migration Guide (4.x to 5.x) for comprehensive migration steps.

Diagnostic Commands

Collect System Information

#!/bin/bash
# Wazuh Dashboard Diagnostic Script

echo "=== System Information ==="
uname -a
cat /etc/os-release

echo "\n=== Dashboard Version ==="
dpkg -l | grep wazuh-dashboard  # Debian/Ubuntu
rpm -qa | grep wazuh-dashboard   # RHEL/CentOS

echo "\n=== Service Status ==="
systemctl status wazuh-dashboard

echo "\n=== Port Status ==="
netstat -tlnp | grep 5601

echo "\n=== Recent Logs ==="
tail -50 /var/log/wazuh-dashboard/opensearch_dashboards.log

echo "\n=== Disk Space ==="
df -h

echo "\n=== Memory Usage ==="
free -h

echo "\n=== Configuration ==="
grep -v "^#" /etc/wazuh-dashboard/opensearch_dashboards.yml | grep -v "^$"

echo "\n=== Installed Plugins ==="
sudo -u wazuh-dashboard /usr/share/wazuh-dashboard/bin/opensearch-dashboards-plugin list

echo "\n=== Indexer Health ==="
curl -X GET "https://localhost:9200/_cluster/health?pretty" -u admin:admin -k

echo "\n=== API Health ==="
curl -k -u wazuh-wui:wazuh-wui https://localhost:55000/

Export Logs for Support

# Create diagnostic bundle
sudo tar -czf wazuh-dashboard-diagnostics-$(date +%Y%m%d-%H%M%S).tar.gz \
  /var/log/wazuh-dashboard/ \
  /etc/wazuh-dashboard/opensearch_dashboards.yml \
  --exclude=/etc/wazuh-dashboard/certs/*.key

Do not include private keys in diagnostic bundles. Exclude certificate keys and password files.

Getting Help

Community Support

Community forum: https://groups.google.com/g/wazuh
GitHub issues: https://github.com/wazuh/wazuh-dashboard-plugins/issues
Documentation: https://documentation.wazuh.com/

Reporting Issues

When reporting issues, include:

Wazuh version (dashboard, manager, indexer)
Operating system and version
Error messages (complete and unedited)
Relevant logs (sanitized for sensitive data)
Steps to reproduce the issue
Expected vs actual behavior
Recent changes (upgrades, configuration changes)

Enterprise Support

For enterprise support options, visit: https://wazuh.com/professional-services/

Documentation Index

​Common Error Messages

​Filter Could Not Be Created

​Index Pattern Not Found

​Server API Not Available

​No Server API Selected

​Connection Issues

​Dashboard Cannot Connect to Indexer

​Dashboard Cannot Connect to Wazuh API

​Service Issues

​Dashboard Service Fails to Start

​Dashboard Service Crashes

​Authentication and Authorization Issues

​Login Failures

​Permission Denied Errors

​Data and Display Issues

​No Data Displayed

​Visualizations Not Loading

​Saved Objects Missing

​Performance Issues

​Slow Dashboard Performance

​High Memory Usage

​Plugin Issues

​Plugin Errors

​Upgrade and Migration Issues

​Upgrade Failures

​Migration Issues

​Diagnostic Commands

​Collect System Information

​Export Logs for Support

​Getting Help

​Community Support

​Reporting Issues

​Enterprise Support

Common Error Messages

Filter Could Not Be Created

Index Pattern Not Found

Server API Not Available

No Server API Selected

Connection Issues

Dashboard Cannot Connect to Indexer

Dashboard Cannot Connect to Wazuh API

Service Issues

Dashboard Service Fails to Start

Dashboard Service Crashes

Authentication and Authorization Issues

Login Failures

Permission Denied Errors

Data and Display Issues

No Data Displayed

Visualizations Not Loading

Saved Objects Missing

Performance Issues

Slow Dashboard Performance

High Memory Usage

Plugin Issues

Plugin Errors

Upgrade and Migration Issues

Upgrade Failures

Migration Issues

Diagnostic Commands

Collect System Information

Export Logs for Support

Getting Help

Community Support

Reporting Issues

Enterprise Support