Install Wazuh Indexer Step-by-Step (Single-Node and Multi-Node)

The Wazuh indexer is a highly scalable full-text search engine that stores Wazuh alerts and events. This guide installs it step by step following the official Wazuh documentation. The process has three stages: certificate creation, indexer node install and cluster initialization. Run every command as root.

1. Generate SSL certificates

Download the certificate tool and the configuration template:

curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

Edit config.yml so the node names and IP addresses match your deployment, then create the certs:

bash ./wazuh-certs-tool.sh -A

Compress and protect the bundle:

tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
rm -rf ./wazuh-certificates

2. Add the Wazuh repository

On APT-based systems (Debian/Ubuntu):

apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
apt-get update

On YUM-based systems (RHEL/CentOS/Rocky/Alma):

rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

3. Install the Wazuh indexer package

# Debian/Ubuntu
apt-get -y install wazuh-indexer

# RHEL/CentOS
yum -y install wazuh-indexer

4. Configure the indexer node

Edit `/etc/wazuh-indexer/opensearch.yml` and set network.host, node.name and cluster.initial_master_nodes to match your config.yml. Then deploy the node certs:

NODE_NAME=node-1
mkdir /etc/wazuh-indexer/certs
tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
chmod 500 /etc/wazuh-indexer/certs
chmod 400 /etc/wazuh-indexer/certs/*
chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs

5. Start the service

systemctl daemon-reload
systemctl enable wazuh-indexer
systemctl start wazuh-indexer

6. Initialize the cluster

On the first node only, run the security initialization. This loads the internal users and applies the security index:

/usr/share/wazuh-indexer/bin/indexer-security-init.sh

7. Verify cluster health

curl -k -u admin:admin https://<INDEXER_IP>:9200
curl -k -u admin:admin https://<INDEXER_IP>:9200/_cat/nodes?v

A green or yellow status with your node listed confirms the indexer is up. Move on to installing the Wazuh server next.