{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "item": { "id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "slug": "plan-wazuh-archive-indexing-separately-from-raw-event-retention", "url": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention.md", "json": "https://update.dsesecurity.com/api/v1/posts/plan-wazuh-archive-indexing-separately-from-raw-event-retention/" }, "title": "Plan Wazuh archive indexing separately from raw event retention", "summary": "Separate Wazuh raw archive retention from dashboard indexing. Review JSON archiving, Filebeat and the archive index pattern together, with capacity and deletion ownership defined first.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-30T06:47:20+00:00", "modified_at": "2026-10-30T06:47:28+00:00", "reviewed_on": "2026-10-30", "reading_minutes": 3, "word_count": 506, "potentially_affected": "Wazuh manager deployments considering raw event archives and their dashboard visualization.", "dse_recommendation": "DSE recommends approving the archive population and capacity plan before enabling the separate manager-to-dashboard path.", "primary_source": { "name": "Wazuh — Event logging", "url": "https://documentation.wazuh.com/current/user-manual/manager/event-logging.html", "published_on": null, "authority": "documentation.wazuh.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Decide whether raw event retention and dashboard exploration are both required. Plan their separate configuration steps and storage consequences before enabling a broad archive population.

\n

Source fact: documented behavior

\n

The Event logging guide says raw archives include received events that do not trigger rules, are disabled by default and can consume substantial storage over time.

\n

It distinguishes syslog-format logall from JSON logall_json, identifying the JSON option as the route for an index usable by the dashboard.

\n

Dashboard visualization additionally requires Filebeat archiving and a wazuh-archives-* index pattern using the timestamp field.

\n

What the source does not establish

\n

This article plans archive collection and visualization. It does not prescribe a legal retention period, prove complete endpoint collection or claim that compression and rotation enforce the organization’s deletion policy.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends approving the archive population and capacity plan before enabling the separate manager-to-dashboard path.

\n
    \n
  1. Describe a bounded investigation need and identify why ordinary alerts are insufficient for it. Name the retained event population and its owner. Establish a capacity observation and an explicit removal or transfer decision through the organization’s retention process. Do not enable indefinite raw collection as an unexplained troubleshooting habit, especially when only one short investigation is intended.
    2. \n
  2. Review the required archive format with the person who will consume it. If dashboard exploration is required, include the documented JSON, Filebeat and index-pattern checkpoints in the same plan. Keep manager-side file creation separate from successful indexing. Record the intended time field and pattern so an operator does not search the normal alerts population and conclude that unalerted events are absent.
    3. \n
  3. Choose a harmless identifiable event for an approved trial and define where it should be visible at each checkpoint. Preserve the existing settings before the change and name the conditions for stopping collection. If a checkpoint fails, investigate that handoff without expanding the source population or extending retention merely to obtain a visible dashboard result.
    4. \n
\n

Verification and evidence

\n

Proposed verification: trace the harmless event from the selected manager archive file to the intended archive index and dashboard view. Preserve the event identity and times with the actual configuration references. Include an approved event that is not expected to become a security alert so the archive requirement is tested independently of the ordinary alert path.

\n

Observe actual storage growth during the agreed trial and reconcile it with the capacity allowance. Record whether the planned stop, deletion or transfer action was completed through its authorized process. These are proposed checks, not performed collection or indexing results; a single event trace does not establish complete retention or a universal performance limit.

\n

Official references

\n\n

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.

\n", "content_text": "Bottom line: Decide whether raw event retention and dashboard exploration are both required. Plan their separate configuration steps and storage consequences before enabling a broad archive population.\nSource fact: documented behavior\nThe Event logging guide says raw archives include received events that do not trigger rules, are disabled by default and can consume substantial storage over time.\nIt distinguishes syslog-format logall from JSON logall_json, identifying the JSON option as the route for an index usable by the dashboard.\nDashboard visualization additionally requires Filebeat archiving and a wazuh-archives-* index pattern using the timestamp field.\nWhat the source does not establish\nThis article plans archive collection and visualization. It does not prescribe a legal retention period, prove complete endpoint collection or claim that compression and rotation enforce the organization’s deletion policy.\nApplicability questions\n\nIs the requirement raw retention, indexed exploration or both?\nWhat event population and sensitive fields are authorized?\nWho owns disk capacity and the deletion decision?\nWhich manager, Filebeat and dashboard checkpoints will be observed?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends approving the archive population and capacity plan before enabling the separate manager-to-dashboard path.\n\nDescribe a bounded investigation need and identify why ordinary alerts are insufficient for it. Name the retained event population and its owner. Establish a capacity observation and an explicit removal or transfer decision through the organization’s retention process. Do not enable indefinite raw collection as an unexplained troubleshooting habit, especially when only one short investigation is intended.\nReview the required archive format with the person who will consume it. If dashboard exploration is required, include the documented JSON, Filebeat and index-pattern checkpoints in the same plan. Keep manager-side file creation separate from successful indexing. Record the intended time field and pattern so an operator does not search the normal alerts population and conclude that unalerted events are absent.\nChoose a harmless identifiable event for an approved trial and define where it should be visible at each checkpoint. Preserve the existing settings before the change and name the conditions for stopping collection. If a checkpoint fails, investigate that handoff without expanding the source population or extending retention merely to obtain a visible dashboard result.\n\nVerification and evidence\nProposed verification: trace the harmless event from the selected manager archive file to the intended archive index and dashboard view. Preserve the event identity and times with the actual configuration references. Include an approved event that is not expected to become a security alert so the archive requirement is tested independently of the ordinary alert path.\nObserve actual storage growth during the agreed trial and reconcile it with the capacity allowance. Record whether the planned stop, deletion or transfer action was completed through its authorized process. These are proposed checks, not performed collection or indexing results; a single event trace does not establish complete retention or a universal performance limit.\nOfficial references\n\nEvent logging — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Decide whether raw event retention and dashboard exploration are both required. Plan their separate configuration steps and storage consequences before enabling a broad archive population.\n\n## Source fact: documented behavior\n\nThe [Event logging](https://documentation.wazuh.com/current/user-manual/manager/event-logging.html) guide says raw archives include received events that do not trigger rules, are disabled by default and can consume substantial storage over time.\n\nIt distinguishes syslog-format logall from JSON logall_json, identifying the JSON option as the route for an index usable by the dashboard.\n\nDashboard visualization additionally requires Filebeat archiving and a wazuh-archives-* index pattern using the timestamp field.\n\n## What the source does not establish\n\nThis article plans archive collection and visualization. It does not prescribe a legal retention period, prove complete endpoint collection or claim that compression and rotation enforce the organization’s deletion policy.\n\n## Applicability questions\n\n- Is the requirement raw retention, indexed exploration or both?\n\n- What event population and sensitive fields are authorized?\n\n- Who owns disk capacity and the deletion decision?\n\n- Which manager, Filebeat and dashboard checkpoints will be observed?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends approving the archive population and capacity plan before enabling the separate manager-to-dashboard path.\n\n- Describe a bounded investigation need and identify why ordinary alerts are insufficient for it. Name the retained event population and its owner. Establish a capacity observation and an explicit removal or transfer decision through the organization’s retention process. Do not enable indefinite raw collection as an unexplained troubleshooting habit, especially when only one short investigation is intended.\n\n- Review the required archive format with the person who will consume it. If dashboard exploration is required, include the documented JSON, Filebeat and index-pattern checkpoints in the same plan. Keep manager-side file creation separate from successful indexing. Record the intended time field and pattern so an operator does not search the normal alerts population and conclude that unalerted events are absent.\n\n- Choose a harmless identifiable event for an approved trial and define where it should be visible at each checkpoint. Preserve the existing settings before the change and name the conditions for stopping collection. If a checkpoint fails, investigate that handoff without expanding the source population or extending retention merely to obtain a visible dashboard result.\n\n## Verification and evidence\n\nProposed verification: trace the harmless event from the selected manager archive file to the intended archive index and dashboard view. Preserve the event identity and times with the actual configuration references. Include an approved event that is not expected to become a security alert so the archive requirement is tested independently of the ordinary alert path.\n\nObserve actual storage growth during the agreed trial and reconcile it with the capacity allowance. Record whether the planned stop, deletion or transfer action was completed through its authorized process. These are proposed checks, not performed collection or indexing results; a single event trace does not establish complete retention or a universal performance limit.\n\n## Official references\n\n- [Event logging](https://documentation.wazuh.com/current/user-manual/manager/event-logging.html) — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "url": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Plan Wazuh archive indexing separately from raw event retention", "item": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/#article", "identifier": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "url": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/", "headline": "Plan Wazuh archive indexing separately from raw event retention", "description": "Separate Wazuh raw archive retention from dashboard indexing. Review JSON archiving, Filebeat and the archive index pattern together…", "abstract": "Separate Wazuh raw archive retention from dashboard indexing. Review JSON archiving, Filebeat and the archive index pattern together, with capacity and deletion ownership defined first.", "articleBody": "Bottom line: Decide whether raw event retention and dashboard exploration are both required. Plan their separate configuration steps and storage consequences before enabling a broad archive population.\nSource fact: documented behavior\nThe Event logging guide says raw archives include received events that do not trigger rules, are disabled by default and can consume substantial storage over time.\nIt distinguishes syslog-format logall from JSON logall_json, identifying the JSON option as the route for an index usable by the dashboard.\nDashboard visualization additionally requires Filebeat archiving and a wazuh-archives-* index pattern using the timestamp field.\nWhat the source does not establish\nThis article plans archive collection and visualization. It does not prescribe a legal retention period, prove complete endpoint collection or claim that compression and rotation enforce the organization’s deletion policy.\nApplicability questions\n\nIs the requirement raw retention, indexed exploration or both?\nWhat event population and sensitive fields are authorized?\nWho owns disk capacity and the deletion decision?\nWhich manager, Filebeat and dashboard checkpoints will be observed?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends approving the archive population and capacity plan before enabling the separate manager-to-dashboard path.\n\nDescribe a bounded investigation need and identify why ordinary alerts are insufficient for it. Name the retained event population and its owner. Establish a capacity observation and an explicit removal or transfer decision through the organization’s retention process. Do not enable indefinite raw collection as an unexplained troubleshooting habit, especially when only one short investigation is intended.\nReview the required archive format with the person who will consume it. If dashboard exploration is required, include the documented JSON, Filebeat and index-pattern checkpoints in the same plan. Keep manager-side file creation separate from successful indexing. Record the intended time field and pattern so an operator does not search the normal alerts population and conclude that unalerted events are absent.\nChoose a harmless identifiable event for an approved trial and define where it should be visible at each checkpoint. Preserve the existing settings before the change and name the conditions for stopping collection. If a checkpoint fails, investigate that handoff without expanding the source population or extending retention merely to obtain a visible dashboard result.\n\nVerification and evidence\nProposed verification: trace the harmless event from the selected manager archive file to the intended archive index and dashboard view. Preserve the event identity and times with the actual configuration references. Include an approved event that is not expected to become a security alert so the archive requirement is tested independently of the ordinary alert path.\nObserve actual storage growth during the agreed trial and reconcile it with the capacity allowance. Record whether the planned stop, deletion or transfer action was completed through its authorized process. These are proposed checks, not performed collection or indexing results; a single event trace does not establish complete retention or a universal performance limit.\nOfficial references\n\nEvent logging — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:47:20+00:00", "dateModified": "2026-10-30T06:47:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/plan-wazuh-archive-indexing-separately-from-raw-event-retention/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan Wazuh archive indexing separately from raw event retention" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 506, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Wazuh — Event logging", "url": "https://documentation.wazuh.com/current/user-manual/manager/event-logging.html" } } ] } }