How to Export Wazuh Alerts and Archived Events
Summary
A guide to exporting Wazuh alerts from manager files or the OpenSearch indexer, filtering records, and accessing full_log data. It explains that exporting all received events requires enabling logall_json in advance.
Key points
- Wazuh manager alerts are stored in alerts.json and rotated into compressed daily files; corresponding alerts are also indexed in OpenSearch.
- Enable logall_json in ossec.conf to archive all received events; archives are available only from when the setting is enabled.
- The guide provides commands to copy current alerts, decompress rotated files, filter by agent with jq, and extract full_log lines.
- The indexer can be queried by agent name and timestamp; users need read access to the alert indices.
- Some alerts lack full_log, so the article recommends exporting alert JSON for those records.
- The article describes uploading files to LogTotal but does not provide details for its sanitize or review steps.
Article Details
- Topic
- Exporting, sanitizing, and reviewing Wazuh alerts and archived logs
Products
LogTotalBelow is how to export alerts and events, sanitize them, and investigate them for free in LogTotal.OpenSearchThe same alerts are indexed in the Wazuh indexer (OpenSearch), in wazuh-alerts-4.x-*.WazuhWazuh keeps its data in two places. On the Wazuh manager, alerts are written to /var/ossec/logs/alerts/alerts.json, one JSON object per line, and rotated daily into compressed files by date.