Wazuh Compliance Reports Visualization Error

[siri102]

Wazuh	Elastic
3.9.4	7.3

Description
When we are clicking on PCI DSS reports in Wazuh App the following error is thrown

Error in visualization. Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"},{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"wazuh-alerts-3.x-2019.08.22","node":"uehBV3NhTcSyDIQMYAwUnA","reason":{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"}},{"shard":0,"index":"wazuh-alerts-3.x-2019.08.23","node":"uehBV3NhTcSyDIQMYAwUnA","reason":{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"}}],"caused_by":{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty","caused_by":{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"}}},"status":400}

Also attached the elasticsearch logs. Which timestamp values are also getting displayed which interval is actually null?

logs.txt

[jesusgn90]

Hi @siri102 ,

I could not reproduce your issue. Can you share the selected time range when this error appears? Is it happening regardless of the filters and time range being applied?

Regards,
Jesús

[siri102]

Hi @jesusgn90,

What I noticed is, Wazuh is working prefectly in Default space but I am getting this issue in Customized Space. I don't even find wazuh-monitoring-* index in customized space which is visible in Default Space. So are we supposed to use Wazuh-App only in Default Space in Kibana?

Thanks in advance

[jesusgn90]

Yes, that's right @siri102. We were working on it, for the next incoming version (3.10.0) the Wazuh app will be compatible with Kibana spaces see #1234, #1601, and #1450.

The only thing you will need is to go to Management in Kibana and to create the index pattern for the Wazuh alerts in that custom space, then the app would work with no issues.

Thanks for your patience.

Regards,
Jesús