A single Wazuh Indexer node is fine for labs, but production needs high availability and capacity for growing event volumes. The official guide recommends a 3-node cluster: each node is master-eligible and holds data, giving redundancy and ~3x ingest throughput.
1. Plan the topology
- Node 1: 10.0.0.11 (node-1)
- Node 2: 10.0.0.12 (node-2)
- Node 3: 10.0.0.13 (node-3)
- Each node: 8 vCPU, 16 GB RAM, 200 GB SSD
2. Generate certificates
curl -sO https://packages.wazuh.com/4.13/wazuh-certs-tool.sh
curl -sO https://packages.wazuh.com/4.13/config.yml
# edit config.yml with the 3 node IPs/hostnames
bash ./wazuh-certs-tool.sh -A3. Install the indexer on each node
curl -sO https://packages.wazuh.com/4.13/wazuh-install.sh
bash ./wazuh-install.sh --wazuh-indexer node-14. Bootstrap the cluster (run once from any node)
bash ./wazuh-install.sh --start-cluster5. Verify cluster health
curl -k -u admin:<password> https://10.0.0.11:9200/_cluster/health?pretty
curl -k -u admin:<password> https://10.0.0.11:9200/_cat/nodes?vNote: Cluster status must be green and node.total must be 3. Yellow means replicas are unassigned; red means primaries are missing.
We design and operate Wazuh Indexer clusters that handle 100k+ EPS, contact us for architecture.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
Wazuh IndexerClusterHA