| 1 | --- |
| 2 | title: Index management (Wazuh Indexer) |
| 3 | description: Monitor index health, disk usage by customer, and manage retention in the Wazuh Indexer. |
| 4 | --- |
| 5 | |
| 6 | # Index management (Wazuh Indexer) |
| 7 | |
| 8 | **Menu:** Log Management → Index Management |
| 9 | |
| 10 | **Best for:** Admin / Engineer |
| 11 | |
| 12 | Index Management gives you an operational view of your **Wazuh Indexer** storage and index health. |
| 13 | |
| 14 | This matters because the indexer is where your SIEM data lives — if storage or index health degrades, search/alerting and investigations degrade with it. |
| 15 | |
| 16 |  |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## What you can do here |
| 21 | |
| 22 | - Check overall **indexer health** (high-level “are we OK?” signal) |
| 23 | - See **storage usage by customer** (who is consuming the most disk) |
| 24 | - Identify large/noisy indexes |
| 25 | - Delete indexes when appropriate (careful: destructive) |
| 26 | |
| 27 | --- |
| 28 | |
| 29 | ## Step 1 — Review overall health |
| 30 | |
| 31 |  |
| 32 | |
| 33 | Use this as your first stop when you see: |
| 34 | - searches slowing down |
| 35 | - ingestion backpressure |
| 36 | - dashboards timing out |
| 37 | - alerting gaps |
| 38 | |
| 39 | --- |
| 40 | |
| 41 | ## Step 2 — Review storage by customer (who is using the disk?) |
| 42 | |
| 43 |  |
| 44 | |
| 45 | This view helps you answer: |
| 46 | - Which customers have the highest log volume? |
| 47 | - Which customer is driving storage growth this week? |
| 48 | - Do we need to tune ingestion/noise upstream? |
| 49 | |
| 50 | Practical actions: |
| 51 | - confirm high-volume customers match expectations (endpoint count, integrations) |
| 52 | - tune noisy sources (drop/suppress earlier in the pipeline) |
| 53 | - adjust retention strategy |
| 54 | |
| 55 | --- |
| 56 | |
| 57 | ## Step 3 — Delete indexes (only when you mean it) |
| 58 | |
| 59 |  |
| 60 | |
| 61 | Deleting an index is destructive. |
| 62 | |
| 63 | Use cases: |
| 64 | - removing test/lab data |
| 65 | - cleaning up misconfigured pipelines that created junk indexes |
| 66 | - emergency disk recovery (prefer snapshots + retention tuning first) |
| 67 | |
| 68 | --- |
| 69 | |
| 70 | ## Related: cold storage via Snapshot & Restore |
| 71 | |
| 72 | If you need to free up space without losing historical logs, use: |
| 73 | - [Snapshot & Restore](/user/ui/indices-snapshots) |