Follow Wazuh keeps its data in two places. On the Wazuh manager, alerts are written to /var/ossec/logs/alerts/alerts.json, one JSON object per line, and rotated daily into compressed files by date. The same alerts are indexed in the Wazuh indexer (OpenSearch), in wazuh-alerts-4.x-*. Either way, the original log line that triggered an alert is in full_log. To export every event, not just the ones that matched a rule, the manager needs archiving turned on.
Wazuh is the most widely used open-source SIEM and XDR, and its data is easy to get at once you know where to look. Prime Core has 23,542 detection rules for Wazuh, mapped to 671 MITRE ATT&CK techniques. Below is how to export alerts and events, sanitize them, and investigate them for free in LogTotal.
Before you start
Alerts or archives? Alerts are the events that matched a Wazuh rule above the alert level threshold. Archives hold everything the manager received, but only if logall_json is enabled in ossec.conf. If the question is “what else happened on that host?”, you want archives, and they only exist from the moment they were turned on.
Permissions. On the manager, the files are owned by the wazuh user and group, so use sudo. For the indexer, you need a user with read access to the alert indices.
Retention. The manager’s rotated files stay until someone deletes them. The indexer keeps what its index lifecycle policy allows.
Option 1: Files on the manager
# today's alerts so far
sudo cp /var/ossec/logs/alerts/alerts.json ./wazuh_alerts_today.jsonl
# a past day (rotated and compressed)
sudo zcat /var/ossec/logs/alerts/2026/Oct/ossec-alerts-19.json.gz > wazuh_alerts_1019.jsonl
# one agent only
jq -c 'select(.agent.name == "web-03")' wazuh_alerts_1019.jsonl > web-03_alerts_1019.jsonl
# the original log lines behind the alerts
jq -r '.full_log // empty' web-03_alerts_1019.jsonl > web-03_raw_1019.log
With archiving enabled, the same pattern works for /var/ossec/logs/archives/archives.json and its rotated files under /var/ossec/logs/archives/<year>/<month>/.
Option 2: The Wazuh indexer
The indexer is OpenSearch, so our applies as written. Point it at wazuh-alerts-* and filter on agent.name and timestamp:
query = {"query": {"bool": {"filter": [
{"term": {"agent.name": "web-03"}},
{"range": {"timestamp": {"gte": "2026-10-19T00:00:00Z", "lt": "2026-10-20T00:00:00Z"}}},
]}}}
The Wazuh dashboard can also generate reports, but not in a format LogTotal reads today.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file: the alert JSON, or the raw lines from full_log.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Permission denied on the manager | Files belong to the wazuh user | Use sudo |
| archives.json empty or missing | logall_json isn’t enabled | Enable it for the future; use alerts for the past |
| No file for a past day | Different rotation path or naming | List /var/ossec/logs/alerts/<year>/<month>/ |
| Some alerts have no full_log | Not every alert comes from a log line (integrity checks, vulnerability detection) | Upload the alert JSON instead |
| Indexer returns 403 | User lacks read access to wazuh-alerts-* | Grant read on the alert indices |
FAQ
Can I use the Wazuh API to export alerts?
The Wazuh server API is for managing agents and configuration, not for searching alerts. Use the files or the indexer.
Raw lines or alert JSON?
Raw lines (full_log) when you want LogTotal to run its own detections on the original logs. Alert JSON when you also want Wazuh’s rule matches in the file.
