Wazuh template ILM policy resets to blank post-upgrade to 4.4.4

[Nightingale_John (John)]

Hi,

I use Wazuh with Elastic, and recently I performed an update of wazuh to 4.4.4. Since the upgrade the ILM policy on the Wazuh template reset to null and therefore indexes didn't roll over.

I thought i fixed the index template:

PUT _template/wazuh
{
  "index_patterns": ["wazuh-alerts-4.x-*"],
  "settings": {
    "index.lifecycle.name": "wazuh",
    "index.lifecycle.rollover_alias" : "wazuh-alerts-4.x"
  }
}

This managed to fix it temporarily, but then the index didnt roll over again, and checking the index template the ILM policy is blank again. Putting it back using the above code worked, but then i saw within 10 mins the policy was reset to blank again.

Any ideas?

[leandrojmp (Leandro Pereira)]

@Nightingale_John

This managed to fix it temporarily, but then the index didnt roll over again, and checking the index template the ILM policy is blank again. Putting it back using the above code worked, but then i saw within 10 mins the policy was reset to blank again.

You need to edit the source json template file for wazuh, if you are using filebeat it will overwrite the template you have.

[Nightingale_John (John)]

Ah thanks Leandro!