wazuh-dashboard not starting after upgrade. "this action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open"

[troublestarter]

Hi Team

I followed the instructions to upgrade wazuh. I'm on Ubuntu 22.04, and i have an issue to start wazuh-dashboard. I upgrade from wazuh 4.5 to 4.7

I found this : #222
But can't have the same result (maybe because i was already working with wazuh-indexer and not opensearch or elasticsearch), for exemple :

Wazuh-indexer seems to work well :

Thanks you for your help

[dleicam]

The same happens to me, after an upgrade it gives the same error.

[troublestarter]

@dleicam Have you succeed the upgrade ?

[dp466]

Ive got the same issue on a Docker deployment
my Wazuh dashboard container keep restarting in a loop

anyone found a solution ?

[troublestarter]

I have resolved like this :

To remove older data you can make use of the API:

Get the list of indices:
curl -u elastic:Password -s -k -X GET https://:9200/_cat/indices?s=index
Remove older indices:
curl -u elastic:Password -s -k -X DELETE https://:9200/wazuh*YYYY.MM.DD
Where YYYY.MM.DD is the date of the data you need to remove.