Install Wazuh Server (Manager + Filebeat) Step-by-Step

The Wazuh server includes the Wazuh manager (analysis and alerting) and Filebeat (which ships alerts to the indexer). This step-by-step guide follows the official Wazuh documentation. Run every command as root.

1. Add the Wazuh repository

Skip this step if you already added the repository when installing the indexer on the same host.

# Debian/Ubuntu
apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
apt-get update

2. Install the Wazuh manager

# Debian/Ubuntu
apt-get -y install wazuh-manager

# RHEL/CentOS
yum -y install wazuh-manager

systemctl daemon-reload
systemctl enable wazuh-manager
systemctl start wazuh-manager
systemctl status wazuh-manager

3. Install Filebeat

# Debian/Ubuntu
apt-get -y install filebeat

# RHEL/CentOS
yum -y install filebeat

4. Configure Filebeat

Download the official Filebeat configuration template:

curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.9/tpl/wazuh/filebeat/filebeat.yml

Create the Filebeat keystore and add the indexer credentials:

filebeat keystore create
echo admin | filebeat keystore add username --stdin --force
echo admin | filebeat keystore add password --stdin --force

Download the alerts template for the Wazuh indexer:

curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.9.0/extensions/elasticsearch/7.x/wazuh-template.json
chmod go+r /etc/filebeat/wazuh-template.json

Install the Wazuh Filebeat module:

curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module

5. Deploy the certificates

NODE_NAME=wazuh-server
mkdir /etc/filebeat/certs
tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
chmod 500 /etc/filebeat/certs
chmod 400 /etc/filebeat/certs/*
chown -R root:root /etc/filebeat/certs

6. Start Filebeat

systemctl daemon-reload
systemctl enable filebeat
systemctl start filebeat

7. Test the connection

filebeat test output

Successful output confirms Filebeat reaches the indexer. Next step is the Wazuh dashboard.