Wazuh Distributed Deployment: Indexer, Server and Dashboard Setup

For anything beyond a lab, the Wazuh components should live on separate hosts. A distributed deployment isolates failure domains, lets each component scale independently and keeps the indexer (which is the heaviest component) away from the manager and the user-facing dashboard.

Reference architecture

A typical small-to-mid production layout uses three roles on dedicated hosts (or three indexer nodes for HA):

• Wazuh indexer cluster: 1 or 3 nodes (3 for production HA)
• Wazuh server: 1 node running the manager and filebeat
• Wazuh dashboard: 1 node serving the UI on HTTPS

1. Prepare every host

Run on each node:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl gnupg2

2. Generate certificates

Edit `config.yml` on one machine to list every node hostname and IP, then generate the cert bundle:

curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

# Edit config.yml to add your indexer, server and dashboard nodes
sudo bash ./wazuh-certs-tool.sh -A

This produces `wazuh-certificates.tar`. Copy each node certificate to the matching host before continuing.

3. Install the Wazuh indexer

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
sudo bash wazuh-install.sh --wazuh-indexer <indexer-node-name>

Repeat on each indexer node, then initialize the cluster from the first node:

sudo bash wazuh-install.sh --start-cluster

4. Install the Wazuh server

sudo bash wazuh-install.sh --wazuh-server <server-node-name>

The script installs the manager and filebeat together and points filebeat at the indexer addresses you defined in config.yml.

5. Install the Wazuh dashboard

sudo bash wazuh-install.sh --wazuh-dashboard <dashboard-node-name>

Once the dashboard service starts, browse to `https://<dashboard-host>` and sign in with the admin password from `wazuh-passwords.txt`.

6. Health check

From any indexer node:

curl -k -u admin:<password> https://localhost:9200/_cluster/health?pretty

Status should be `green` for a 3-node cluster. `yellow` is acceptable on a single-node setup because replicas cannot be allocated.

Production checklist

• Set `vm.max_map_count=262144` permanently in `/etc/sysctl.conf`
• Increase `ulimit -n` for the indexer service
• Mount a dedicated, fast disk for `/var/lib/wazuh-indexer`
• Configure index lifecycle (ILM) for log retention
• Put the dashboard behind a reverse proxy with a real TLS certificate
• Schedule daily snapshots of indexer data

We run distributed Wazuh deployments daily, if you want a production rollout designed and managed for you, reach out via our contact page.