Increase default index replica setting

[Fabian1976]

Hello,

We are running the Wazuh Kibana app on an Elasticsearch cluster with minimum 3 master nodes and 2 data nodes.
We had 1 data node crash and had to recover the cluster. All indices could restore, except for the wazuh-monitoring and wazuh-statistics indices because the default replica was set to 0:
https://github.com/wazuh/wazuh-kibana-app/blob/3d1ca8eca54a10787b546812b4c6bf32552350f8/common/constants.ts#L43

Is it an option to set this setting to 1? Or to add an auto-expand 0-1 to it? Now we had to delete al these indices to get the cluster working again. Not a big issue, but it's just not good practice to have 0 replicas.
Or do you assume Wazuh is always running a single node Elasticsearch instance?

We could change it in the interface, but we do everything from code so it would be nice if the defaults are also Elasticsearch best practices.

Or maybe there is an option to set the parameter via a curl command? That would also be helpfull.

Kind regards,

Fabian.

[jctello]

Hi @Fabian1976,

Sorry you have lost the wazuh-monitoring and statistics information. The default value is not set to auto-expand since the common use case is to focus mainly on the wazuh-alerts indices which can be restored through the compressed alerts.json files as explained here: https://wazuh.com/blog/recover-your-data-using-wazuh-alert-backups/ and the disk storage can be a determining factor in many environments.

Given that each use case is different and I understand you may want to have replicas for all indices, this can be modified through the web interface by going into wazuh → Settings → Configuration and setting the Index replicas on both the Monitoring and Statistics sections.

You may also achieve this by editing /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and adding the following variables:
wazuh.monitoring.replicas: 1
cron.statistics.replicas: 1

Remember to restart the wazuh-dashboard service afterwards.