I am using Wazuh 4.7.3-1, but I forgot to configure the index management (ILM), so I encounter the typical error message ‘cluster currently has [1000]/[1000] maximum shards open)’. Obviously this situation lasted for 3 weeks. As a quick fix, I deleted some old indexes from the early days of the server and it started working again as soon as new data arrived.
The thing is, I need to have the data from those 3 weeks in the system.

I found the missing period in the archive /var/ossec/logs/archives/2024.
I searched the web and found the hint to re-import the archived logs with ‘ossec-logtest < logfile.log’, but this ‘re-import’ does not create an index for me. The other results I found on the web about indexes were how to transfer them (node to node), but that’s not what I need.
What other options do I have to access the data in the GUI again – or what step have I forgotten?