Importing existing Wazuh data

[ws25iy93hk]

Trying to see if it is possible to import the data from an existing Wazuh deployment after a new installation of SO has completed so the data already connected will not be lost?

[weslambert]

You may be able to move logs over into the respective directories in /nsm/wazuh/logs and have them picked up by Filebeat, however, I've not tested this, and this is not necessarily something we claim to support OOB. If you are referring to Elastic data, then I would say no, as there could very likely be quite a few differences is mapping/data types etc.

[ws25iy93hk]

Using Wazuh for FIM and compliance. Just trying to now have two reports to cover the same timeframe. Sounds like it might be possible but the work might over run the time.
Thanks for the reply.