Error: Shards Failed

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

“number” : “7.10.2”

“lucene_version” : “9.12.1”,

Describe the issue:

Hello everyone,

I need your help.
I installed the Wazuh 4.12 suite on Debian 12.
I installed my agents, everything is fine, I have the information for each one, everything is OK.
However, on the dashboard, when I don’t select a machine, I get “Shards Failed” errors message Opensearch.

I don’t know where this is coming from.
I’ve included the details with the other screenshots.

Thank you for your help.

Configuration:

Relevant Logs or Screenshots

wazuh-error-B
wazuh-error-B1528×1410 282 KB

2

Hi @threepwood77 ,

You should first get a good understanding of shards https://opensearch.org/blog/optimize-opensearch-index-shard-size/. Another doc to review be - Cluster settings - OpenSearch Documentation

Then you could check the health of the cluster and GET /_cluster/health?pretty and see what shards are failing.

Let me know what you find,

Leeroy.

3

Thank you for your reply.
I looked at both links, but I admit I’m a little lost with all this information…
Actually, I was already using the Wazuh suite, which uses Opensearch, on another machine and didn’t have this problem after installation.
I haven’t touched the options, but I’ll check the configuration files to see if there’s a setting I missed…
Here is the command output:

{
“cluster_name” : “wazuh-cluster”,
“status” : “yellow”,
“timed_out” : false,
“number_of_nodes” : 1,
“number_of_data_nodes” : 1,
“discovered_master” : true,
“discovered_cluster_manager” : true,
“active_primary_shards” : 93,
“active_shards” : 93,
“relocating_shards” : 0,
“initializing_shards” : 0,
“unassigned_shards” : 6,
“delayed_unassigned_shards” : 0,
“number_of_pending_tasks” : 0,
“number_of_in_flight_fetch” : 0,
“task_max_waiting_in_queue_millis” : 0,
“active_shards_percent_as_number” : 93.93939393939394
}

4

Hi @threepwood77 ,

Did you cross check the configuration to see if you had anything different between configs?

Try using GET _cat/indices and checking for which are unassigned in the list.

Leeroy.