To show on the forum your configuration, you need to post it as text, follow the instructions here:
Mikrotik configurations need to be read/checked in their entirety, as a mis-setting in an area/section that you believe unrelated may actually be the cause of an issue.
Decoders should be in /var/ossec/etc/decoders/ on the Wazuh server.
From the info you posted till now the Mikrotik somehow sends some data to the Wazuh server, but this latter does not "understand" what it receives, so it does seem like the issue is on Wazuh side (and that would be something that would go outside the scope of the Mikrotik forum and likely outside the competence of its members) but let's first check that data is properly sent, if this is confirmed to be OK, then you can go to:
https://wazuh.com/community/
(slack 
)
and ask for assistance there, knowing that "this" side everything is as it should be.