Wazuh

https://documentation.wazuh.com/current/
Admin
Wazuh is an open-source security platform that provides threat detection, incident response, and...
Tokens:1,648,147
Snippets:11,364
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Run install.sh (Solaris 11)

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-agent/index.html

Starts the installation wizard for the Wazuh agent from sources. The wizard will guide you through the installation process.

```bash
# cd wazuh*
# ./install.sh

```

--------------------------------

### Installation wizard output for agent type

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-agent/index.html

Example output from the installation wizard when selecting the agent installation type. The user types 'agent'.

```text
1- What kind of installation do you want (manager, agent, local, hybrid, or help)? agent

```

--------------------------------

### Run install.sh (Solaris 10)

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-agent/index.html

Starts the installation wizard for the Wazuh agent from sources. The wizard will guide you through the installation process.

```bash
# bash install.sh

```

--------------------------------

### Manager/local unattended installation configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/unattended-installation.html

Example preloaded-vars.conf settings for a server (manager) installation. Sets language to English, disables confirmation prompts, installs as server, disables email alerts, enables syscheck and rootcheck, sets white list to 'n', enables syslog, and sets CA store to 'n'.

```bash
USER_LANGUAGE="en"
USER_NO_STOP="y"
USER_INSTALL_TYPE="server"
USER_DIR="/var/ossec"
USER_ENABLE_EMAIL="n"
USER_ENABLE_SYSCHECK="y"
USER_ENABLE_ROOTCHECK="y"
USER_WHITE_LIST="n"
USER_ENABLE_SYSLOG="y"
USER_CA_STORE="n"

```

--------------------------------

### Agent unattended installation configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/unattended-installation.html

Example preloaded-vars.conf settings for an agent installation. Sets language to English, disables confirmation prompts, installs as agent, and enables syscheck, rootcheck, and active response.

```bash
USER_LANGUAGE="en"
USER_NO_STOP="y"
USER_INSTALL_TYPE="agent"
USER_DIR="/var/ossec"
USER_ENABLE_SYSCHECK="y"
USER_ENABLE_ROOTCHECK="y"
USER_ENABLE_ACTIVE_RESPONSE="y"

```

--------------------------------

### Install and start NFS server (Yum and APT)

Source: https://documentation.wazuh.com/current/user-manual/wazuh-indexer/migrating-wazuh-indices.html

Installs and starts the NFS server on the dedicated server. The Yum commands are for RHEL/CentOS, while the APT commands are for Debian/Ubuntu.

```bash
# yum update
# yum install -y nfs-utils
# yum install exportfs
# systemctl enable nfs-server
# systemctl start nfs-server

```

```bash
# apt -y install nfs-kernel-server
# systemctl start nfs-kernel-server.service

```

--------------------------------

### Output of puppet module install

Source: https://documentation.wazuh.com/current/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.html

Example output from the `puppet module install` command, showing the installation location and the dependency tree of the Wazuh module.

```text
Notice: Preparing to install into /etc/puppetlabs/code/environments/production/modules ...
Notice: Downloading from https://forgeapi.puppet.com ...
Notice: Installing -- do not interrupt ...
/etc/puppetlabs/code/environments/production/modules
└─┬ wazuh-wazuh (v4.14.5)
  ├── puppet-archive (v8.0.0)
  ├── puppet-nodejs (v10.0.0)
  ├── puppet-selinux (v4.1.0)
  ├── puppet-zypprepo (v5.0.0)
  ├── puppetlabs-apt (v10.0.1)
  ├── puppetlabs-concat (v9.0.2)
  ├── puppetlabs-firewall (v8.1.7)
  ├─┬ puppetlabs-powershell (v6.0.1)
  │ └── puppetlabs-pwshlib (v1.2.3)
  └── puppetlabs-stdlib (v9.6.0)

```

--------------------------------

### Example output for specific package query

Source: https://documentation.wazuh.com/current/user-manual/capabilities/system-inventory/viewing-system-inventory-data.html

Example JSON response from the Wazuh indexer showing the Wazuh Agent package installed on a Windows endpoint.

```json
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 10.26218,
    "hits" : [
      {
        "_index" : "wazuh-states-inventory-packages-wazuh-vmware-virtual-platform",
        "_id" : "005_717e026c55c0e6b98d7a00d73963ca70cba8609f",
        "_score" : 10.26218,
        "_source" : {
          "agent" : {
            "id" : "005",
            "name" : "Windows-11",
            "version" : "v4.14.0"
          },
          "package" : {
            "architecture" : "i686",
            "name" : "Wazuh Agent",
            "size" : 0,
            "type" : "win",
            "vendor" : "Wazuh",
            "version" : "4.13.0"
          },
          "wazuh" : {
            "cluster" : {
              "name" : "wazuh-VMware-Virtual-Platform"
            },
            "schema" : {
              "version" : "1.0"
            }
          }
        }
      }
    ]
  }
}

```

--------------------------------

### Sample <command> configuration for Unix and Windows

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/commands.html

Provides sample configurations for Unix and Windows systems. The Unix example uses a custom script with extra arguments and timeout allowed. The Windows example uses route-null.exe with timeout allowed.

```xml
<!-- For Unix systems -->
<command>
  <name>custom_command</name>
  <executable>custom_script</executable>
  <extra_args>arg1 arg2 arg3</extra_args>
  <timeout_allowed>yes</timeout_allowed>
</command>

<!-- For Windows systems -->
<command>
  <name>win_route-null</name>
  <executable>route-null.exe</executable>
  <timeout_allowed>yes</timeout_allowed>
</command>
```

--------------------------------

### Initialize cluster

Source: https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/installation-assistant.html

Runs the installation assistant with --start-cluster on any Wazuh indexer node to load new certificates and start the cluster. Only run once.

```bash
# bash wazuh-install.sh --start-cluster
```

--------------------------------

### Response for GET _cat/plugins

Source: https://documentation.wazuh.com/current/user-manual/indexer-api/reference.html

Example response for the CAT plugins operation. Lists installed plugins with their component names and versions.

```json
[
  * {
    * "name": "node-1",
    * "component": "opensearch-alerting",
    * "version": "2.16.0.0"
},
  * {
    * "name": "node-1",
    * "component": "opensearch-anomaly-detection",
    * "version": "2.16.0.0"
},
  * {
    * "name": "node-1",
    * "component": "opensearch-asynchronous-search",
    * "version": "2.16.0.0"
},
  * {
    * "name": "node-1",
    * "component": "opensearch-cross-cluster-replication",
    * "version": "2.16.0.0"
}
]
```

--------------------------------

### GET /_analyze response tokens

Source: https://documentation.wazuh.com/current/user-manual/indexer-api/reference.html

Example response for the GET /_analyze endpoint, showing the tokens produced by the text analysis. Each token includes the token text, start and end offsets, type, and position.

```json
{
  "tokens": [
    {
      "token": "test",
      "start_offset": 0,
      "end_offset": 4,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "word",
      "start_offset": 5,
      "end_offset": 9,
      "type": "<ALPHANUM>",
      "position": 1
    }
  ]
}
```

--------------------------------

### Example launcher.sh command

Source: https://documentation.wazuh.com/current/development/packaging/generate-dashboard-package.html

Example of running launcher.sh with version 4.14.8, revision 1, and a file path to the tar.gz package.

```bash
$ ./launcher.sh -v 4.14.8 -r 1 -p file:///wazuh-dashboard-4.14.8-1-linux-x64.tar.gz

```

--------------------------------

### Start Wazuh agent on macOS

Source: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-macos.html

Starts the Wazuh agent after installation to complete the deployment process. This command is used for both CLI and GUI installation methods.

```bash
# launchctl bootstrap system /Library/LaunchDaemons/com.wazuh.agent.plist

```

--------------------------------

### SCA configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/sca.html

Complete SCA configuration example showing enabled, scan_on_start, time, skip_nfs, and policies.

```xml
<sca>
  <enabled>yes</enabled>
  <scan_on_start>yes</scan_on_start>
  <time>04:00</time>
  <skip_nfs>yes</skip_nfs>

  <policies>
    <policy>etc/shared/cis_debian10.yml</policy>
    <policy enabled="no">ruleset/sca/cis_debian9.yml</policy>
    <policy>/my/custom/policy/path/my_policy.yaml</policy>
  </policies>
</sca>
```

--------------------------------

### Sample task-manager configuration

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/task-manager.html

Example configuration setting cleanup_time to 2d and task_timeout to 1h. cleanup_time must be greater than or equal to task_timeout.

```xml
<task-manager>
  <cleanup_time>2d</cleanup_time>
  <task_timeout>1h</task_timeout>
</task-manager>

```

--------------------------------

### Select agent installation type

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-agent/index.html

Example prompt and response when the installer asks for the installation type. Type 'agent' to install a Wazuh agent.

```text
1- What kind of installation do you want (manager, agent, local, hybrid or help)? agent

```

--------------------------------

### Docker wodle configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-docker.html

Example configuration for the Docker wodle. Sets interval to 10 minutes, attempts to 5, disables run_on_start, and keeps the wodle enabled.

```xml
<wodle name="docker-listener">
    <interval>10m</interval>
    <attempts>5</attempts>
    <run_on_start>no</run_on_start>
    <disabled>no</disabled>
</wodle>

```

--------------------------------

### gcp-bucket configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/gcp-bucket.html

A complete configuration example for the gcp-bucket module on Linux. It sets run_on_start to yes, interval to 1m, and includes a bucket with name, credentials_file, only_logs_after, path, and remove_from_bucket options.

```xml
<gcp-bucket>
    <run_on_start>yes</run_on_start>
    <interval>1m</interval>
    <bucket type="access_logs">
        <name>wazuh-test-bucket</name>
        <credentials_file>/var/ossec/wodles/gcloud/credentials.json</credentials_file>
        <only_logs_after>2021-JUN-01</only_logs_after>
        <path>access_logs/</path>
        <remove_from_bucket>no</remove_from_bucket>
    </bucket>
</gcp-bucket>
```

--------------------------------

### Install gnupg and apt-transport-https

Source: https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/adding-new-server-nodes/all-in-one-deployment.html

Installs required packages for the APT repository setup.

```bash
# apt-get install gnupg apt-transport-https

```

--------------------------------

### Start Wazuh manager with systemctl

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-server/index.html

Start the Wazuh manager service using systemd if you chose not to start it at the end of installation.

```bash
# systemctl start wazuh-manager

```

--------------------------------

### Linux fluent-forward configuration examples

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/fluent-forward.html

Linux configuration examples for the fluent-forward module. The first block shows a simple setup without TLS, while the second adds TLS with a shared key, CA file, and user/password authentication.

```xml
<!-- Simple usage without using TLS -->
<fluent-forward>
  <enabled>yes</enabled>
  <socket_path>/var/run/fluent.sock</socket_path>
  <address>localhost</address>
  <port>24224</port>
</fluent-forward>

<!-- Simple usage using TLS -->
<fluent-forward>
  <enabled>yes</enabled>
  <socket_path>/var/run/fluent.sock</socket_path>
  <address>localhost</address>
  <port>24224</port>
  <shared_key>secret_string</shared_key>
  <ca_file>/root/certs/fluent.crt</ca_file>
  <user>foo</user>
  <password>bar</password>
</fluent-forward>
```

--------------------------------

### Example log from program 'example'

Source: https://documentation.wazuh.com/current/user-manual/ruleset/decoders/custom.html

Example log from a program called 'example' used to demonstrate creating custom decoders and rules.

```text
Dec 25 20:45:02 MyHost example[12345]: User 'admin' logged from '192.168.1.100'

```

--------------------------------

### Start Wazuh manager with service command

Source: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-server/index.html

Start the Wazuh manager service using SysV init if you chose not to start it at the end of installation.

```bash
# service wazuh-manager start

```

--------------------------------

### Install and refresh core snap with output

Source: https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/configuring-third-party-certs/ssl.html

Install and refresh the core snap, then verify the installation. The output shows the installed core version and confirms no updates are available.

```bash
# snap install core; snap refresh core

```

```text
core 16-2.61.4-20240607 from Canonical✓ installed
snap "core" has no updates available

```

--------------------------------

### Install and enable Auditd

Source: https://documentation.wazuh.com/current/proof-of-concept-guide/audit-commands-run-by-user.html

Installs, starts, and enables Auditd on the Ubuntu endpoint if it is not already present.

```bash
$ sudo apt -y install auditd
$ sudo systemctl start auditd
$ sudo systemctl enable auditd

```

--------------------------------

### Example output for all packages query

Source: https://documentation.wazuh.com/current/user-manual/capabilities/system-inventory/viewing-system-inventory-data.html

Example JSON response from the Wazuh indexer showing a package entry for the wazuh-agent package on a CentOS endpoint.

```json
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 6.9660244,
    "hits" : [
      {
        "_index" : "wazuh-states-inventory-packages-wazuh-vmware-virtual-platform",
        "_id" : "006_1cdcea1b59fb2fd59b3de004d393bcbcfea352ee",
        "_score" : 6.9660244,
        "_source" : {
          "agent" : {
            "id" : "006",
            "name" : "Cent_Stream",
            "version" : "v4.14.0"
          },
          "package" : {
            "architecture" : "x86_64",
            "description" : "Wazuh helps you to gain security visibility into your infrastructure by monitoring\nhosts at an operating system and application level. It provides the following capabilities:\nlog analysis, file integrity monitoring, intrusions detection and policy and compliance monitoring",
            "installed" : "2025-09-12T18:04:48.000Z",
            "name" : "wazuh-agent",
            "size" : 31169915,
            "type" : "rpm",
            "vendor" : "Wazuh",
            "version" : "4.13.0-1"
          },
          "wazuh" : {
            "cluster" : {
              "name" : "wazuh-VMware-Virtual-Platform"
            },
            "schema" : {
              "version" : "1.0"
            }
          }
        }
      }
    ]
  }
}

```

--------------------------------

### Start Wazuh agent on AIX

Source: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-aix.html

Starts the Wazuh agent service after installation to complete the deployment process.

```bash
# /var/ossec/bin/wazuh-control start

```

--------------------------------

### Copy example Osquery configuration

Source: https://documentation.wazuh.com/current/user-manual/capabilities/system-inventory/osquery.html

Copies the example Osquery configuration file to /etc/osquery/osquery.conf.

```bash
# cp /opt/osquery/share/osquery/osquery.example.conf /etc/osquery/osquery.conf
```

--------------------------------

### GET /agents - Query Examples

Source: https://documentation.wazuh.com/current/user-manual/api/queries.html

Examples of using the OR (`,`) operator and LIKE AS (`~`) in the /agents endpoint query parameter.

```APIDOC
## [GET] /agents

### Description
This endpoint retrieves agents information. The examples demonstrate the use of the OR (`,`) operator and LIKE AS (`~`) to filter agents whose operating system name contains _windows_ or _centos_.

### Method
GET

### Endpoint
/agents

### Parameters
#### Query Parameters
- **q** (string) - Required - Filter query using operators. Example: `os.name~centos,os.name~windows`
- **limit** (integer) - Optional - Maximum number of elements to return. Example: `500`
- **pretty** (boolean) - Optional - Pretty print the response. Example: `true`
- **select** (string) - Optional - Fields to return. Example: `id,name,os.name,os.version,os.codename,os.major`

### Request Example
```
curl -G --data-urlencode "q=os.name~centos,os.name~windows" -k -X GET "https://localhost:55000/agents?limit=500&pretty=true&select=id,name,os.name,os.version,os.codename,os.major" -H  "Authorization: Bearer $TOKEN"
```

### Response
#### Success Response (200)
- **data.affected_items** (array) - List of agents matching the filter.
- **data.total_affected_items** (integer) - Total number of affected items.
- **data.total_failed_items** (integer) - Total number of failed items.
- **data.failed_items** (array) - List of failed items.
- **message** (string) - Response message.
- **error** (integer) - Error code (0 for success).

#### Response Example
```
{
   "data": {
      "affected_items": [
         {
            "os": {
               "major": "6",
               "name": "Microsoft Windows 7 Ultimate Edition Professional Service Pack 1",
               "version": "6.1.7601"
            },
            "name": "jmv74211-PC",
            "id": "013"
         }
      ],
      "total_affected_items": 1,
      "total_failed_items": 0,
      "failed_items": []
   },
   "message": "All selected agents information was returned",
   "error": 0
}
```
```

```APIDOC
## [GET] /agents

### Description
This endpoint retrieves agents information. The example demonstrates the use of multiple operators at the same time: `id!=0;id<4;name~waz;(os.major=16,os.major=18)` to filter agents with id other than 0 and lower than 4, whose name contains the substring `waz` and whose major version is 16 or 18.

### Method
GET

### Endpoint
/agents

### Parameters
#### Query Parameters
- **q** (string) - Required - Filter query using operators. Example: `id!=0;id<4;name~waz;(os.major=16,os.major=18)`
- **limit** (integer) - Optional - Maximum number of elements to return. Example: `500`
- **pretty** (boolean) - Optional - Pretty print the response. Example: `true`
- **select** (string) - Optional - Fields to return. Example: `id,name,os.name,os.version,os.codename,os.major`

### Request Example
```
curl -G --data-urlencode "q=id!=0;id<4;name~waz;(os.major=16,os.major=18)" -k -X GET "https://localhost:55000/agents?limit=500&pretty=true&select=id,name,os.name,os.version,os.codename,os.major" -H  "Authorization: Bearer $TOKEN"
```

### Response
#### Success Response (200)
- **data.affected_items** (array) - List of agents matching the filter.
- **data.total_affected_items** (integer) - Total number of affected items.
- **data.total_failed_items** (integer) - Total number of failed items.
- **data.failed_items** (array) - List of failed items.
- **message** (string) - Response message.
- **error** (integer) - Error code (0 for success).

#### Response Example
```
{
   "data": {
      "affected_items": [
         {
            "os": {
               "codename": "Xenial Xerus",
               "major": "16",
               "name": "Ubuntu",
               "version": "16.04.6 LTS"
            },
            "name": "wazuh-agent1",
            "id": "001"
         },
         {
            "os": {
               "codename": "Xenial Xerus",
               "major": "16",
               "name": "Ubuntu",
               "version": "16.04.6 LTS"
            },
            "name": "wazuh-agent2",
            "id": "002"
         },
         {
            "os": {
               "codename": "Xenial Xerus",
               "major": "16",
               "name": "Ubuntu",
               "version": "16.04.6 LTS"
            },
            "name": "wazuh-agent3",
            "id": "003"
         }
      ],
      "total_affected_items": 3,
      "total_failed_items": 0,
      "failed_items": []
   },
   "message": "All selected agents information was returned",
   "error": 0
}
```
```

```APIDOC
## [GET] /agents

### Description
This endpoint retrieves agents information. The example demonstrates the use of parentheses and multiple operators to filter agents with an ID higher than `007` that run on _Windows_ or whose operating system major version is either 14 or 18.

### Method
GET

### Endpoint
/agents

### Parameters
#### Query Parameters
- **q** (string) - Required - Filter query using operators. Example: `id>007;(os.name~windows,(os.major=14,os.major=18))`
- **limit** (integer) - Optional - Maximum number of elements to return. Example: `500`
- **pretty** (boolean) - Optional - Pretty print the response. Example: `true`
- **select** (string) - Optional - Fields to return. Example: `id,name,os.name,os.version,os.codename,os.major`

### Request Example
```
curl -G --data-urlencode "q=id>007;(os.name~windows,(os.major=14,os.major=18))" -k -X GET "https://localhost:55000/agents?limit=500&pretty=true&select=id,name,os.name,os.version,os.codename,os.major" -H  "Authorization: Bearer $TOKEN"
```

### Response
#### Success Response (200)
- **data.affected_items** (array) - List of agents matching the filter.
- **data.total_affected_items** (integer) - Total number of affected items.
- **data.total_failed_items** (integer) - Total number of failed items.
- **data.failed_items** (array) - List of failed items.
- **message** (string) - Response message.
- **error** (integer) - Error code (0 for success).

#### Response Example
```
{
   "data": {
      "affected_items": [
         {
            "os": {
               "codename": "Bionic Beaver",
               "major": "18",
               "name": "Ubuntu",
               "version": "18.04.4 LTS"
            },
            "name": "wazuh-agent8",
            "id": "008"
         },
         {
            "os": {
               "codename": "Bionic Beaver",
               "major": "18",
               "name": "Ubuntu",
               "version": "18.04.2 LTS"
            },
            "name": "wazuh-agent9",
            "id": "009"
         },
         {
            "os": {
               "codename": "Bionic Beaver",
               "major": "18",
               "name": "Ubuntu",
               "version": "18.04.2 LTS"
            },
            "name": "wazuh-agent10",
            "id": "010"
         },
         {
            "os": {
               "major": "6",
               "name": "Microsoft Windows 7 Ultimate Edition Professional Service Pack 1",
               "version": "6.1.7601"
            },
            "name": "jmv74211-PC",
            "id": "013"
         }
      ],
      "total_affected_items": 4,
      "total_failed_items": 0,
      "failed_items": []
   },
   "message": "All selected agents information was returned",
   "error": 0
}
```
```

--------------------------------

### gcp-pubsub configuration example

Source: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/gcp-pubsub.html

Example configuration for the gcp-pubsub module with pull_on_start, interval, project_id, subscription_name, and credentials_file.

```xml
<gcp-pubsub>
    <pull_on_start>yes</pull_on_start>
    <interval>1m</interval>
    <project_id>wazuh-dev</project_id>
    <subscription_name>wazuhdns</subscription_name>
    <credentials_file>wodles/gcp-pubsub/credentials.json</credentials_file>
</gcp-pubsub>
```

--------------------------------

### GET /_cat/segment_replication/{index}

Source: https://documentation.wazuh.com/current/user-manual/indexer-api/reference.html

Documentation for the GET /_cat/segment_replication/{index} endpoint, including parameters, authorizations, and response examples.

```APIDOC
## GET /_cat/segment_replication/{index}

### Description
Returns information about active and last completed segment replication events on each replica shard, including related shard-level metrics. These metrics provide information about how far behind the primary shard the replicas are lagging.

### Method
GET

### Endpoint
{protocol}://{host}:{port}/_cat/segment_replication/{index}

### Parameters
#### Path Parameters
- **index** (string) - Required - The name of the index.

#### Query Parameters
- **active_only** (boolean) - Optional - Default: false - Returns the shard recoveries that are currently in progress, when set to true.
- **allow_no_indices** (boolean) - Optional - Default: false - Controls whether to ignore the index if a wildcard index expression resolves to no concrete indexes. This includes the _all string or when no indexes have been specified.
- **bytes** (string) - Optional - The units used to display byte values. Valid values are: b, kb, k, mb, m, gb, g, tb, t, pb, p.
- **completed_only** (boolean) - Optional - Default: false - When set to true, the response only includes the last-completed segment replication events.
- **detailed** (boolean) - Optional - Default: false - Returns detailed information about shard recoveries when set to true.
- **expand_wildcards** (string or Array of strings) - Optional - Specifies the type of index that wildcard expressions can match. Supports comma-separated values. Valid values are: all, closed, hidden, none, open.
- **format** (string) - Optional - A short version of the HTTP Accept header, such as json or yaml.
- **h** (string or Array of strings) - Optional - A comma-separated list of column names to display.
- **help** (boolean) - Optional - Default: false - Returns help information.
- **ignore_throttled** (boolean) - Optional - Whether specified concrete, expanded, or aliased indexes should be ignored when throttled.
- **ignore_unavailable** (boolean) - Optional - Controls if the specified concrete indexes should be ignored when missing or closed.
- **s** (string or Array of strings) - Optional - A comma-separated list of column names or column aliases to sort by.
- **shards** (Array of strings) - Optional - A comma-separated list of shards to display.
- **time** (string <duration>) - Optional - Specifies the time units, for example, 5d or 7h. Valid values are: nanos, micros, ms, s, m, h, d.
- **timeout** (string <duration>) - Optional - Specifies how long the indexer node should wait before the operation timeout.
- **v** (boolean) - Optional - Default: false - Enables verbose mode, which displays column headers.

### Authorizations
_basicAuth_ _jwtAuth_

### Responses
#### Success Response (200)
OK

#### Response Example
```json
[
  {
    "shardId": "[index-1][0]",
    "target_node": "node1",
    "target_host": "192.168.1.100",
    "checkpoints_behind": 0,
    "bytes_behind": 0,
    "current_lag": "0s",
    "last_completed_lag": "0s",
    "rejected_requests": 0
  },
  {
    "shardId": "[index-2][0]",
    "target_node": "node2",
    "target_host": "192.168.1.101",
    "checkpoints_behind": 1,
    "bytes_behind": 1024,
    "current_lag": "10ms",
    "last_completed_lag": "5ms",
    "rejected_requests": 0
  }
]
```

#### Error Responses
- **400** - Response to report a bad request
- **401** - Response to report an unauthorized request
- **403** - Response to report a permission denied request
- **405** - Response to report an invalid HTTP method
```
Tokens:
Raw