Wazuh Monitoring Index Patterns#

This guide provides comprehensive documentation for Wazuh monitoring index patterns, focusing on the invinsense-monitoring indices and their role in XDR (Extended Detection and Response) data management. Understanding these patterns is crucial for effective security monitoring and incident response.

Table of Contents#

Understanding Monitoring Index Patterns#

The monitoring indices (invinsense-monitoring-*) are generated through a systematic process that ensures comprehensive agent status tracking and security event monitoring. These indices form the backbone of the XDR platform’s observability capabilities.

Index Generation Process#

1
graph TD
2
    A[XDR Plugin] --> B[Agent Status Polling]
3
    B --> C[Data Processing & Formatting]
4
    C --> D[Template Application]
5
    D --> E[Index Creation]
6
    E --> F[Time-based Storage]
7

8
    G[Monitoring Templates] --> D
9
    H[Configuration Settings] --> B
10
    I[Agent Heartbeats] --> B
11

12
    F --> J[invinsense-monitoring-YYYY.MM.DD]
13

14
    style A fill:#ff6b6b
15
    style F fill:#4ecdc4
16
    style J fill:#45b7d1

The process involves several key stages:

Source Generation: Wazuh agents report their status periodically
Processing Pipeline: Data is formatted according to index templates
Index Creation: Time-based indices are created following naming conventions
Storage Configuration: Data is stored with appropriate retention policies

Core Index Constants#

The system uses several critical constants that define the monitoring infrastructure:

Index Type Definitions#

1
// Core monitoring constants
2
export const WAZUH_INDEX_TYPE_MONITORING = "monitoring";
3
export const WAZUH_MONITORING_PREFIX = "invinsense-monitoring-";
4
export const WAZUH_MONITORING_PATTERN = "invinsense-monitoring-*";
5
export const WAZUH_MONITORING_TEMPLATE_NAME = "wazuh-agent";

Index Naming Convention#

The monitoring indices follow a strict naming pattern:

Pattern: invinsense-monitoring-YYYY.MM.DD
Example: invinsense-monitoring-2025.02.02
Rotation: Daily by default (configurable)

Index Architecture#

Data Flow Architecture#

1
graph TB
2
    subgraph "Agent Layer"
3
        A1[Wazuh Agent 1]
4
        A2[Wazuh Agent 2]
5
        A3[Wazuh Agent N]
6
    end
7

8
    subgraph "Collection Layer"
9
        B1[Agent Status Collector]
10
        B2[Heartbeat Monitor]
11
        B3[Performance Metrics]
12
    end
13

14
    subgraph "Processing Layer"
15
        C1[Data Formatter]
16
        C2[Template Engine]
17
        C3[Index Manager]
18
    end
19

20
    subgraph "Storage Layer"
21
        D1[invinsense-monitoring-2025.02.01]
22
        D2[invinsense-monitoring-2025.02.02]
23
        D3[invinsense-monitoring-2025.02.03]
24
    end
25

26
    A1 --> B1
27
    A2 --> B1
28
    A3 --> B1
29

30
    A1 --> B2
31
    A2 --> B2
32
    A3 --> B2
33

34
    B1 --> C1
35
    B2 --> C1
36
    B3 --> C1
37

38
    C1 --> C2
39
    C2 --> C3
40

41
    C3 --> D1
42
    C3 --> D2
43
    C3 --> D3

Index Template Structure#

1
{
2
  "index_patterns": ["invinsense-monitoring-*"],
3
  "template": {
4
    "settings": {
5
      "number_of_shards": 1,
6
      "number_of_replicas": 1,
7
      "index.refresh_interval": "5s",
8
      "index.max_result_window": 10000
9
    },
10
    "mappings": {
11
      "properties": {
12
        "@timestamp": {
13
          "type": "date",
14
          "format": "strict_date_optional_time||epoch_millis"
15
        },
16
        "agent": {
17
          "properties": {
18
            "id": {
19
              "type": "keyword"
20
            },
21
            "name": {
22
              "type": "keyword"
23
            },
24
            "ip": {
25
              "type": "ip"
26
            },
27
            "status": {
28
              "type": "keyword"
29
            },
30
            "version": {
31
              "type": "keyword"
32
            },
33
            "os": {
34
              "properties": {
35
                "name": {
36
                  "type": "keyword"
37
                },
38
                "platform": {
39
                  "type": "keyword"
40
                },
41
                "version": {
42
                  "type": "keyword"
43
                }
44
              }
45
            }
46
          }
47
        },
48
        "monitoring": {
49
          "properties": {
50
            "status": {
51
              "type": "keyword"
52
            },
53
            "last_heartbeat": {
54
              "type": "date"
55
            },
56
            "uptime": {
57
              "type": "long"
58
            },
59
            "cpu_usage": {
60
              "type": "float"
61
            },
62
            "memory_usage": {
63
              "type": "float"
64
            },
65
            "disk_usage": {
66
              "type": "float"
67
            }
68
          }
69
        }
70
      }
71
    }
72
  }
73
}

Configuration Management#

Index Settings Configuration#

1
# Monitoring index configuration
2
monitoring:
3
  indices:
4
    prefix: "invinsense-monitoring-"
5
    pattern: "invinsense-monitoring-*"
6
    rotation: "daily" # daily, weekly, monthly
7
    retention: "30d" # 30 days retention
8

9
  settings:
10
    shards: 1
11
    replicas: 1
12
    refresh_interval: "5s"
13
    max_result_window: 10000
14

15
  collection:
16
    interval: "15m" # Agent status collection interval
17
    timeout: "30s" # Collection timeout
18
    batch_size: 1000 # Documents per batch

Template Management#

1
#!/bin/bash
2

3
# Monitoring index template management script
4
TEMPLATE_NAME="wazuh-agent-monitoring"
5
TEMPLATE_PATTERN="invinsense-monitoring-*"
6

7
# Create monitoring template
8
create_monitoring_template() {
9
    curl -X PUT "localhost:9200/_index_template/${TEMPLATE_NAME}" \
10
         -H "Content-Type: application/json" \
11
         -d '{
12
           "index_patterns": ["'${TEMPLATE_PATTERN}'"],
13
           "template": {
14
             "settings": {
15
               "number_of_shards": 1,
16
               "number_of_replicas": 1,
17
               "index.refresh_interval": "5s"
18
             },
19
             "mappings": {
20
               "properties": {
21
                 "@timestamp": {"type": "date"},
22
                 "agent": {
23
                   "properties": {
24
                     "id": {"type": "keyword"},
25
                     "name": {"type": "keyword"},
26
                     "status": {"type": "keyword"}
27
                   }
28
                 }
29
               }
30
             }
31
           }
32
         }'
33
}
34

35
# Verify template
36
verify_template() {
37
    curl -X GET "localhost:9200/_index_template/${TEMPLATE_NAME}"
38
}
39

40
# Execute functions
41
create_monitoring_template
42
verify_template

Data Collection Process#

Agent Status Collection#

The XDR plugin periodically polls agent status data through the following process:

1
// Agent status collection implementation
2
class AgentStatusCollector {
3
  constructor(config) {
4
    this.interval = config.interval || 900000; // 15 minutes
5
    this.indexPrefix = config.indexPrefix || "invinsense-monitoring-";
6
    this.batchSize = config.batchSize || 1000;
7
  }
8

9
  async collectAgentStatus() {
10
    try {
11
      // Fetch agent status from Wazuh API
12
      const agents = await this.wazuhAPI.getAgents();
13

14
      // Process and format data
15
      const monitoringData = this.formatMonitoringData(agents);
16

17
      // Create index with timestamp
18
      const indexName = this.generateIndexName();
19

20
      // Bulk insert data
21
      await this.bulkInsert(indexName, monitoringData);
22

23
      console.log(`Collected status for ${agents.length} agents`);
24
    } catch (error) {
25
      console.error("Agent status collection failed:", error);
26
    }
27
  }
28

29
  generateIndexName() {
30
    const now = new Date();
31
    const dateStr = now.toISOString().split("T")[0].replace(/-/g, ".");
32
    return `${this.indexPrefix}${dateStr}`;
33
  }
34

35
  formatMonitoringData(agents) {
36
    return agents.map(agent => ({
37
      "@timestamp": new Date().toISOString(),
38
      agent: {
39
        id: agent.id,
40
        name: agent.name,
41
        ip: agent.ip,
42
        status: agent.status,
43
        version: agent.version,
44
        os: {
45
          name: agent.os?.name,
46
          platform: agent.os?.platform,
47
          version: agent.os?.version,
48
        },
49
      },
50
      monitoring: {
51
        status: this.determineMonitoringStatus(agent),
52
        last_heartbeat: agent.lastKeepAlive,
53
        uptime: agent.uptime || 0,
54
      },
55
    }));
56
  }
57

58
  determineMonitoringStatus(agent) {
59
    const statuses = ["active", "disconnected", "pending", "never_connected"];
60
    return statuses.includes(agent.status) ? agent.status : "unknown";
61
  }
62
}

Scheduling and Automation#

1
// Scheduler service for monitoring data collection
2
class MonitoringScheduler {
3
  constructor(collector, config) {
4
    this.collector = collector;
5
    this.interval = config.interval || 900000; // 15 minutes
6
    this.isRunning = false;
7
  }
8

9
  start() {
10
    if (this.isRunning) return;
11

12
    this.isRunning = true;
13
    console.log("Starting monitoring data collection...");
14

15
    // Initial collection
16
    this.collector.collectAgentStatus();
17

18
    // Schedule periodic collection
19
    this.intervalId = setInterval(() => {
20
      this.collector.collectAgentStatus();
21
    }, this.interval);
22
  }
23

24
  stop() {
25
    if (!this.isRunning) return;
26

27
    this.isRunning = false;
28
    clearInterval(this.intervalId);
29
    console.log("Stopped monitoring data collection");
30
  }
31
}

Index Lifecycle Management#

Retention Policies#

1
{
2
  "policy": {
3
    "phases": {
4
      "hot": {
5
        "actions": {
6
          "rollover": {
7
            "max_size": "5GB",
8
            "max_age": "1d",
9
            "max_docs": 1000000
10
          }
11
        }
12
      },
13
      "warm": {
14
        "min_age": "1d",
15
        "actions": {
16
          "allocate": {
17
            "number_of_replicas": 0
18
          }
19
        }
20
      },
21
      "cold": {
22
        "min_age": "7d",
23
        "actions": {
24
          "allocate": {
25
            "number_of_replicas": 0
26
          }
27
        }
28
      },
29
      "delete": {
30
        "min_age": "30d"
31
      }
32
    }
33
  }
34
}

Index Management Script#

1
#!/bin/bash
2

3
# Index lifecycle management for monitoring indices
4
MONITORING_PATTERN="invinsense-monitoring-*"
5
RETENTION_DAYS=30
6

7
# Function to delete old indices
8
cleanup_old_indices() {
9
    local cutoff_date=$(date -d "${RETENTION_DAYS} days ago" +%Y.%m.%d)
10

11
    echo "Cleaning up indices older than ${cutoff_date}"
12

13
    # Get list of indices matching pattern
14
    indices=$(curl -s "localhost:9200/_cat/indices/${MONITORING_PATTERN}?h=index" | grep "invinsense-monitoring")
15

16
    for index in $indices; do
17
        # Extract date from index name
18
        index_date=$(echo $index | sed 's/invinsense-monitoring-//')
19

20
        # Compare dates
21
        if [[ "$index_date" < "$cutoff_date" ]]; then
22
            echo "Deleting old index: $index"
23
            curl -X DELETE "localhost:9200/$index"
24
        fi
25
    done
26
}
27

28
# Function to optimize indices
29
optimize_indices() {
30
    echo "Optimizing monitoring indices..."
31

32
    # Force merge old indices
33
    curl -X POST "localhost:9200/${MONITORING_PATTERN}/_forcemerge?max_num_segments=1"
34

35
    # Update replica settings for old indices
36
    local week_ago=$(date -d "7 days ago" +%Y.%m.%d)
37

38
    curl -X PUT "localhost:9200/invinsense-monitoring-*/_settings" \
39
         -H "Content-Type: application/json" \
40
         -d '{
41
           "index": {
42
             "number_of_replicas": 0
43
           }
44
         }'
45
}
46

47
# Main execution
48
main() {
49
    echo "Starting index lifecycle management..."
50
    cleanup_old_indices
51
    optimize_indices
52
    echo "Index lifecycle management completed"
53
}
54

55
# Run if executed directly
56
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
57
    main "$@"
58
fi

Monitoring and Analytics#

Index Health Monitoring#

1
#!/bin/bash
2

3
# Monitoring index health check script
4
check_monitoring_indices() {
5
    echo "=== Monitoring Index Health Check ==="
6

7
    # Check cluster health
8
    cluster_health=$(curl -s "localhost:9200/_cluster/health" | jq -r '.status')
9
    echo "Cluster Health: $cluster_health"
10

11
    # Check monitoring indices count
12
    index_count=$(curl -s "localhost:9200/_cat/indices/invinsense-monitoring-*?h=index" | wc -l)
13
    echo "Monitoring Indices Count: $index_count"
14

15
    # Check today's index
16
    today=$(date +%Y.%m.%d)
17
    today_index="invinsense-monitoring-$today"
18

19
    index_exists=$(curl -s -o /dev/null -w "%{http_code}" "localhost:9200/$today_index")
20
    if [[ "$index_exists" == "200" ]]; then
21
        echo "✅ Today's index ($today_index) exists"
22

23
        # Get document count
24
        doc_count=$(curl -s "localhost:9200/$today_index/_count" | jq -r '.count')
25
        echo "  Documents: $doc_count"
26

27
        # Get index size
28
        index_size=$(curl -s "localhost:9200/_cat/indices/$today_index?h=store.size")
29
        echo "  Size: $index_size"
30
    else
31
        echo "❌ Today's index ($today_index) not found"
32
    fi
33

34
    # Check for any yellow or red indices
35
    unhealthy=$(curl -s "localhost:9200/_cat/indices/invinsense-monitoring-*?h=index,health" | grep -v green)
36
    if [[ -n "$unhealthy" ]]; then
37
        echo "⚠️ Unhealthy indices found:"
38
        echo "$unhealthy"
39
    else
40
        echo "✅ All monitoring indices are healthy"
41
    fi
42
}
43

44
# Agent status analytics
45
analyze_agent_status() {
46
    echo "=== Agent Status Analytics ==="
47

48
    # Get latest agent status distribution
49
    status_distribution=$(curl -s "localhost:9200/invinsense-monitoring-*/_search" \
50
        -H "Content-Type: application/json" \
51
        -d '{
52
          "size": 0,
53
          "query": {
54
            "range": {
55
              "@timestamp": {
56
                "gte": "now-1h"
57
              }
58
            }
59
          },
60
          "aggs": {
61
            "status_distribution": {
62
              "terms": {
63
                "field": "agent.status"
64
              }
65
            }
66
          }
67
        }' | jq -r '.aggregations.status_distribution.buckets[] | "\(.key): \(.doc_count)"')
68

69
    echo "Agent Status Distribution (last hour):"
70
    echo "$status_distribution"
71
}
72

73
# Run checks
74
check_monitoring_indices
75
echo ""
76
analyze_agent_status

Performance Metrics#

1
// Performance monitoring for index operations
2
class IndexPerformanceMonitor {
3
  constructor(opensearchClient) {
4
    this.client = opensearchClient;
5
    this.metricsIndex = "monitoring-performance-metrics";
6
  }
7

8
  async collectIndexMetrics() {
9
    const metrics = {
10
      timestamp: new Date().toISOString(),
11
      cluster: await this.getClusterMetrics(),
12
      indices: await this.getIndexMetrics(),
13
      operations: await this.getOperationMetrics(),
14
    };
15

16
    await this.storeMetrics(metrics);
17
    return metrics;
18
  }
19

20
  async getClusterMetrics() {
21
    const health = await this.client.cluster.health();
22
    const stats = await this.client.cluster.stats();
23

24
    return {
25
      status: health.body.status,
26
      active_shards: health.body.active_shards,
27
      node_count: health.body.number_of_nodes,
28
      data_nodes: health.body.number_of_data_nodes,
29
      storage_used: stats.body.indices.store.size_in_bytes,
30
    };
31
  }
32

33
  async getIndexMetrics() {
34
    const indices = await this.client.cat.indices({
35
      index: "invinsense-monitoring-*",
36
      format: "json",
37
    });
38

39
    return indices.body.map(index => ({
40
      name: index.index,
41
      docs_count: parseInt(index["docs.count"]),
42
      store_size: index["store.size"],
43
      health: index.health,
44
      status: index.status,
45
    }));
46
  }
47

48
  async getOperationMetrics() {
49
    const stats = await this.client.indices.stats({
50
      index: "invinsense-monitoring-*",
51
    });
52

53
    const allStats = stats.body._all.total;
54

55
    return {
56
      indexing_rate: allStats.indexing.index_total,
57
      search_rate: allStats.search.query_total,
58
      refresh_rate: allStats.refresh.total,
59
      merge_rate: allStats.merges.total,
60
    };
61
  }
62

63
  async storeMetrics(metrics) {
64
    await this.client.index({
65
      index: this.metricsIndex,
66
      body: metrics,
67
    });
68
  }
69
}

Query Optimization#

Common Query Patterns#

1
// Optimized queries for monitoring data
2
class MonitoringQueries {
3
  constructor(opensearchClient) {
4
    this.client = opensearchClient;
5
    this.indexPattern = "invinsense-monitoring-*";
6
  }
7

8
  // Get agent status distribution
9
  async getAgentStatusDistribution(timeRange = "1h") {
10
    return await this.client.search({
11
      index: this.indexPattern,
12
      body: {
13
        size: 0,
14
        query: {
15
          range: {
16
            "@timestamp": {
17
              gte: `now-${timeRange}`,
18
            },
19
          },
20
        },
21
        aggs: {
22
          status_distribution: {
23
            terms: {
24
              field: "agent.status",
25
              size: 10,
26
            },
27
          },
28
          status_over_time: {
29
            date_histogram: {
30
              field: "@timestamp",
31
              fixed_interval: "5m",
32
            },
33
            aggs: {
34
              status_breakdown: {
35
                terms: {
36
                  field: "agent.status",
37
                },
38
              },
39
            },
40
          },
41
        },
42
      },
43
    });
44
  }
45

46
  // Get disconnected agents
47
  async getDisconnectedAgents(timeRange = "1h") {
48
    return await this.client.search({
49
      index: this.indexPattern,
50
      body: {
51
        query: {
52
          bool: {
53
            must: [
54
              {
55
                term: {
56
                  "agent.status": "disconnected",
57
                },
58
              },
59
              {
60
                range: {
61
                  "@timestamp": {
62
                    gte: `now-${timeRange}`,
63
                  },
64
                },
65
              },
66
            ],
67
          },
68
        },
69
        sort: [
70
          {
71
            "@timestamp": {
72
              order: "desc",
73
            },
74
          },
75
        ],
76
        _source: [
77
          "agent.id",
78
          "agent.name",
79
          "agent.ip",
80
          "monitoring.last_heartbeat",
81
          "@timestamp",
82
        ],
83
      },
84
    });
85
  }
86

87
  // Get agent performance metrics
88
  async getAgentPerformanceMetrics(agentId, timeRange = "24h") {
89
    return await this.client.search({
90
      index: this.indexPattern,
91
      body: {
92
        query: {
93
          bool: {
94
            must: [
95
              {
96
                term: {
97
                  "agent.id": agentId,
98
                },
99
              },
100
              {
101
                range: {
102
                  "@timestamp": {
103
                    gte: `now-${timeRange}`,
104
                  },
105
                },
106
              },
107
            ],
108
          },
109
        },
110
        sort: [
111
          {
112
            "@timestamp": {
113
              order: "asc",
114
            },
115
          },
116
        ],
117
        _source: [
118
          "@timestamp",
119
          "monitoring.cpu_usage",
120
          "monitoring.memory_usage",
121
          "monitoring.disk_usage",
122
          "monitoring.uptime",
123
        ],
124
      },
125
    });
126
  }
127
}

Index Optimization#

1
#!/bin/bash
2

3
# Index optimization script for monitoring indices
4
optimize_monitoring_indices() {
5
    echo "Starting optimization of monitoring indices..."
6

7
    # Get list of indices older than 1 day
8
    old_indices=$(curl -s "localhost:9200/_cat/indices/invinsense-monitoring-*?h=index,creation.date.string" | \
9
                  awk -v cutoff="$(date -d '1 day ago' '+%Y-%m-%d')" '$2 < cutoff {print $1}')
10

11
    for index in $old_indices; do
12
        echo "Optimizing index: $index"
13

14
        # Force merge to reduce segments
15
        curl -X POST "localhost:9200/$index/_forcemerge?max_num_segments=1" \
16
             -H "Content-Type: application/json"
17

18
        # Reduce replica count for old indices
19
        curl -X PUT "localhost:9200/$index/_settings" \
20
             -H "Content-Type: application/json" \
21
             -d '{
22
               "index": {
23
                 "number_of_replicas": 0,
24
                 "refresh_interval": "30s"
25
               }
26
             }'
27
    done
28

29
    echo "Index optimization completed"
30
}
31

32
# Shard allocation optimization
33
optimize_shard_allocation() {
34
    echo "Optimizing shard allocation..."
35

36
    # Enable allocation for specific node types
37
    curl -X PUT "localhost:9200/_cluster/settings" \
38
         -H "Content-Type: application/json" \
39
         -d '{
40
           "persistent": {
41
             "cluster.routing.allocation.node_concurrent_recoveries": 2,
42
             "cluster.routing.allocation.cluster_concurrent_rebalance": 2,
43
             "indices.recovery.max_bytes_per_sec": "100mb"
44
           }
45
         }'
46
}
47

48
# Run optimizations
49
optimize_monitoring_indices
50
optimize_shard_allocation

Security Considerations#

Access Control#

1
# Role-based access control for monitoring indices
2
monitoring_reader:
3
  cluster_permissions: []
4
  index_permissions:
5
    - index_patterns:
6
        - "invinsense-monitoring-*"
7
      allowed_actions:
8
        - "indices:data/read/search*"
9
        - "indices:data/read/get*"
10
        - "indices:admin/mappings/get"
11
        - "indices:monitor/stats"
12

13
monitoring_writer:
14
  cluster_permissions:
15
    - "cluster:admin/ingest/pipeline/get"
16
    - "cluster:admin/ingest/pipeline/simulate"
17
  index_permissions:
18
    - index_patterns:
19
        - "invinsense-monitoring-*"
20
      allowed_actions:
21
        - "indices:data/write/index"
22
        - "indices:data/write/bulk"
23
        - "indices:admin/create"
24
        - "indices:admin/mapping/put"
25

26
monitoring_admin:
27
  cluster_permissions:
28
    - "cluster:monitor/*"
29
    - "cluster:admin/indices/template/*"
30
  index_permissions:
31
    - index_patterns:
32
        - "invinsense-monitoring-*"
33
      allowed_actions:
34
        - "*"

Data Encryption#

1
#!/bin/bash
2

3
# Enable encryption for monitoring indices
4
enable_monitoring_encryption() {
5
    # Create encrypted index template
6
    curl -X PUT "localhost:9200/_index_template/invinsense-monitoring-encrypted" \
7
         -H "Content-Type: application/json" \
8
         -d '{
9
           "index_patterns": ["invinsense-monitoring-*"],
10
           "template": {
11
             "settings": {
12
               "index": {
13
                 "codec": "best_compression",
14
                 "encryption": {
15
                   "enabled": true,
16
                   "key_id": "monitoring_key"
17
                 }
18
               }
19
             }
20
           }
21
         }'
22

23
    echo "Encryption enabled for monitoring indices"
24
}
25

26
# Setup field-level security
27
setup_field_security() {
28
    curl -X PUT "localhost:9200/_plugins/_security/api/roles/monitoring_masked" \
29
         -H "Content-Type: application/json" \
30
         -d '{
31
           "index_permissions": [{
32
             "index_patterns": ["invinsense-monitoring-*"],
33
             "allowed_actions": ["indices:data/read/search"],
34
             "field_level_security": {
35
               "grant": ["agent.id", "agent.name", "agent.status", "@timestamp"],
36
               "except": ["agent.ip", "monitoring.detailed_metrics"]
37
             }
38
           }]
39
         }'
40
}
41

42
enable_monitoring_encryption
43
setup_field_security

Troubleshooting#

Common Issues#

Index Creation Failures#

1
# Diagnostic script for index creation issues
2
diagnose_index_creation() {
3
    echo "=== Index Creation Diagnostics ==="
4

5
    # Check cluster status
6
    cluster_status=$(curl -s "localhost:9200/_cluster/health" | jq -r '.status')
7
    echo "Cluster Status: $cluster_status"
8

9
    # Check template existence
10
    template_exists=$(curl -s -o /dev/null -w "%{http_code}" \
11
                     "localhost:9200/_index_template/wazuh-agent")
12

13
    if [[ "$template_exists" == "200" ]]; then
14
        echo "✅ Monitoring template exists"
15
    else
16
        echo "❌ Monitoring template not found"
17
        echo "Creating template..."
18
        # Template creation logic here
19
    fi
20

21
    # Check disk space
22
    disk_usage=$(curl -s "localhost:9200/_cat/allocation?h=disk.used_percent" | \
23
                awk '{print $1}' | sort -nr | head -1)
24
    echo "Max Disk Usage: ${disk_usage}%"
25

26
    if [[ "${disk_usage%.*}" -gt 85 ]]; then
27
        echo "⚠️ High disk usage detected"
28
    fi
29

30
    # Check for failed shards
31
    failed_shards=$(curl -s "localhost:9200/_cluster/health" | jq -r '.unassigned_shards')
32
    if [[ "$failed_shards" -gt 0 ]]; then
33
        echo "⚠️ Unassigned shards: $failed_shards"
34
    fi
35
}

Performance Issues#

1
# Performance troubleshooting for monitoring indices
2
troubleshoot_performance() {
3
    echo "=== Performance Troubleshooting ==="
4

5
    # Check search latency
6
    search_latency=$(curl -s "localhost:9200/_nodes/stats/indices/search" | \
7
                    jq -r '.nodes[].indices.search.query_time_in_millis')
8
    echo "Search Latency: ${search_latency}ms"
9

10
    # Check indexing rate
11
    indexing_rate=$(curl -s "localhost:9200/_cat/indices/invinsense-monitoring-*?h=indexing.index_total")
12
    echo "Indexing Rate: $indexing_rate docs"
13

14
    # Check segment count
15
    segment_info=$(curl -s "localhost:9200/_cat/segments/invinsense-monitoring-*?h=index,segments.count")
16
    echo "Segment Information:"
17
    echo "$segment_info"
18

19
    # Recommend optimizations
20
    high_segment_indices=$(echo "$segment_info" | awk '$2 > 50 {print $1}')
21
    if [[ -n "$high_segment_indices" ]]; then
22
        echo "⚠️ Indices with high segment count:"
23
        echo "$high_segment_indices"
24
        echo "Recommendation: Run force merge on these indices"
25
    fi
26
}

Best Practices#

Index Management#

Naming Convention: Maintain consistent index naming with date patterns
Template Management: Use index templates for consistent settings
Lifecycle Policies: Implement proper ILM for cost optimization
Monitoring: Regular health checks and performance monitoring

Data Collection#

Batch Processing: Collect and index data in batches for efficiency
Error Handling: Implement robust error handling and retry mechanisms
Rate Limiting: Prevent overwhelming the cluster with too many requests
Data Validation: Validate data before indexing to prevent corruption

Security#

Access Control: Implement role-based access control
Encryption: Use encryption for sensitive monitoring data
Audit Logging: Track access to monitoring indices
Data Masking: Mask sensitive fields in monitoring data

Conclusion#

The Wazuh monitoring index patterns provide a robust foundation for XDR data management and security monitoring. Understanding these patterns, their generation process, and management strategies is crucial for maintaining effective security operations.

Key benefits of this architecture:

Scalable Data Collection: Handle large volumes of agent status data
Time-based Organization: Efficient data organization and retrieval
Performance Optimization: Optimized for both storage and query performance
Security Integration: Built-in security controls and access management
Operational Excellence: Comprehensive monitoring and troubleshooting capabilities

By following the practices and configurations outlined in this guide, organizations can maintain robust monitoring capabilities while ensuring optimal performance and security.