Wazuh - How to get the filterlogs?

[mrmanuel]

Hello,

I'm new to Wazuh and installed it a few days ago. I see some logs from OPNsense in Wazuh but the logs from the filter are missing. I followed the instructions at https://docs.opnsense.org/manual/wazuh-agent.html but unfortunately they did not help me.

On OPNsense under "Services -> Wazuh Agent -> Settings -> Applications" I also selected filter (filterlog) and firewall (firewall).

Is there anything else needed to get the filter logs into Wazuh?

[jobraun2]

Do you have archive logs enabled in Wazuh? (wazuh-archives-* index)

[mrmanuel]

Thanks, that was the correct hint to find the needed steps!

Here are the required steps:

- Enabling archiving
- Visualizing the events on the dashboard
- Wazuh dashboard