Wazuh is an open-source security platform that provides threat detection, compliance management, and incident response capabilities. It uses a distributed architecture where the Wazuh Indexer plays a critical role in storing and searching alert data. In this blog, we\u2019ll walk through the process of installing Wazuh Indexer on Ubuntu 24.04 server using the official Wazuh installation assistant.<\/p>\n\n\n\n
First, download the script for the Wazuh installation assistant and the configuration file:<\/p>\n\n\n\n
#curl -sO https:\/\/packages.wazuh.com\/4.11\/wazuh-install.sh\n#curl -sO https:\/\/packages.wazuh.com\/4.11\/config.yml<\/code><\/pre>\n\n\n\nStep 2: Edit the Configuration File<\/h3>\n\n\n\n
Edit .\/config.yml and replace the node names and IP values:<\/p>\n\n\n\n
# Wazuh indexer nodes\n indexer:\n - name: node-1\n ip: \"<indexer-node-ip>\"<\/code><\/pre>\n\n\n\nAlso do the same for all Wazuh server, and Wazuh dashboard nodes.<\/p>\n\n\n\n
Step 3: Generate Configuration Files<\/h3>\n\n\n\n
Run the Wazuh installation assistant with the option –generate-config-files to generate the Wazuh cluster key, certificates, and passwords necessary for installation:<\/p>\n\n\n\n
#bash wazuh-install.sh --generate-config-files<\/code><\/pre>\n\n\n\nStep 4: Copy Generated Files to All Servers<\/h3>\n\n\n\n
After generation, you will have a file named wazuh-install-files.tar.<\/p>\n\n\n\n
Copy the wazuh-install-files.tar file to all the servers of the distributed deployment<\/p>\n\n\n\n
Step 5: Install and Configure the Wazuh Indexer Node<\/h3>\n\n\n\n
Install and configure the Wazuh indexer nodes:<\/p>\n\n\n\n
Download installation script:<\/p>\n\n\n\n
#curl -sO https:\/\/packages.wazuh.com\/4.11\/wazuh-install.sh<\/code><\/pre>\n\n\n\nRun the script with the option –wazuh-indexer and the node name to install and configure the Wazuh<\/a> indexer.<\/p>\n\n\n\n#bash wazuh-install.sh --wazuh-indexer node-1<\/code><\/pre>\n\n\n\nStep 6: Initialize the Wazuh Indexer Cluster<\/h4>\n\n\n\n
Run the Wazuh installation assistant with the option –start-cluster on any Wazuh indexer node to load the new certificate information and start the cluster.<\/p>\n\n\n\n
#bash wazuh-install.sh --start-cluster<\/code><\/pre>\n\n\n\nStep 7: Cluster installation<\/h4>\n\n\n\n
Run the following command to get the admin password:<\/p>\n\n\n\n
#tar -axf wazuh-install-files.tar wazuh-install-files\/wazuh-passwords.txt -O | grep -P \"\\'admin\\'\" -A 1<\/code><\/pre>\n\n\n\nEg output:<\/p>\n\n\n\n
indexer_username: ‘admin<\/strong>‘<\/p>\n\n\n\n indexer_password: ‘vX?JU7v4Jszt4rcfmBkldC5K.SUbBieo<\/strong>‘<\/p>\n\n\n\nStep 8: Test the Cluster Installation<\/h4>\n\n\n\n
Finally, test your Wazuh Indexer by running a simple API call:<\/p>\n\n\n\n
# curl -k -u admin:vX?JU7v4Jszt4rcfmBkldC5K.SUbBieo https:\/\/127.0.0.1:9200<\/code><\/pre>\n\n\n\nA successful response will look like this:<\/p>\n\n\n\n
{\n \"name\" : \"node-1\",\n \"cluster_name\" : \"wazuh-indexer-cluster\",\n \"cluster_uuid\" : \"lTXL_l7bSZKFAIpOAXollg\",\n \"version\" : {\n \"number\" : \"7.10.2\",\n \"build_type\" : \"deb\",\n \"build_hash\" : \"e5a68d19815af94a9883fead7927edb40181f32d\",\n \"build_date\" : \"2025-03-26T19:08:40.098412Z\",\n \"build_snapshot\" : false,\n \"lucene_version\" : \"9.11.1\",\n \"minimum_wire_compatibility_version\" : \"7.10.0\",\n \"minimum_index_compatibility_version\" : \"7.0.0\"\n },\n \"tagline\" : \"The OpenSearch Project: https:\/\/opensearch.org\/\"\n}<\/code><\/pre>\n\n\n\nConclusion<\/h3>\n\n\n\n
Installing Wazuh Indexer on Ubuntu 24.04 is straightforward with the help of the Wazuh installation assistant.
Following these steps ensures a properly configured, secure, and scalable indexer cluster ready to handle your security event data. If you need further assistance, our support team<\/a> is here to help you with this.<\/p>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
Wazuh is an open-source security platform that provides threat detection, compliance management, and incident response capabilities. It uses a distributed architecture where the Wazuh Indexer plays a critical role in storing and searching alert data. In this blog, we\u2019ll walk through the process of installing Wazuh Indexer on Ubuntu 24.04 server using the official Wazuh […]<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[302,1016],"class_list":["post-14826","post","type-post","status-publish","format-standard","hentry","category-blog","tag-server-management-services","tag-wazuh-indexer-in-ubuntu-24-04"],"_links":{"self":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/14826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/comments?post=14826"}],"version-history":[{"count":3,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/14826\/revisions"}],"predecessor-version":[{"id":14829,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/14826\/revisions\/14829"}],"wp:attachment":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/media?parent=14826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/categories?post=14826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/tags?post=14826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}