13

A Kibana newbie would like to know how to set default index pattern programmatically rather than setting it on the Kibana UI through web browser during the first time viewing Kibana UI as mentioned on page https://www.elastic.co/guide/en/kibana/current/setup.html

OneCricketeer
  • 179,855
  • 19
  • 132
  • 245
Rui
  • 3,454
  • 6
  • 37
  • 70
  • You can follow the progress on Github for this feature, otherwise, you have to use HTTP POST requests to the Kibana API. https://github.com/elastic/kibana/issues/3709 – OneCricketeer Apr 26 '16 at 18:48
  • Thanks for your great suggestion. I found a repeating question: http://stackoverflow.com/questions/28811267/how-to-automate-the-configuration-of-an-index-pattern-in-kibana – Rui Apr 27 '16 at 07:31
  • one of the replies in ISSUE#3709 gave the curl POST command: curl -XPUT http://:9200/.kibana/index-pattern/events-* -d '{"title" : "events-*", "timeFieldName": "EventTime"}' Anyone knows on base of what this request is given? I can not find any related information from Kibana documentation – Rui Apr 27 '16 at 07:43
  • Very loosely, this is the "documentation". Kibana is simply the visualizer. You are creating a Kibana index in Elasticsearch. https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html – OneCricketeer Apr 27 '16 at 07:50

2 Answers2

32

Elasticsearch stores all Kibana metadata information under .kibana index. Kibana configurations like defaultIndex and advance settings are stored under index/type/id .kibana/config/4.5.0 where 4.5.0 is the version of your Kibana.

So you can achieve setting up or changing defaultIndex with following steps:

  1. Add index to Kibana which you want to set as defaultIndex. You can do that by executing following command:

    curl -XPUT http://<es node>:9200/.kibana/index-pattern/your_index_name -d '{"title" : "your_index_name",  "timeFieldName": "timestampFieldNameInYourInputData"}'

  2. Change your Kibana config to set index added earlier as defaultIndex:

    curl -XPUT http://<es node>:9200/.kibana/config/4.5.0 -d '{"defaultIndex" : "your_index_name"}'

Note: Make sure your giving correct index_name everywhere, valid timestamp field name and kibana version for example if you are using kibana 4.1.1 then you can replace 4.5.0 with 4.1.1 .

Kalle Richter
  • 8,008
  • 26
  • 77
  • 177
avr
  • 4,835
  • 1
  • 19
  • 30
  • omg, I tried it just now and it worked perfectly :D Great! Thanks sooo much! I prefer the automation anyway – Rui Jun 13 '16 at 12:57
  • 1
    just in case anyone else made my stupid mistake: in the url above "index-pattern" should not be replaced with your pattern. you should only replace your_index_name. e.g. curl -XPUT http://:9200/.kibana/index-pattern/logstash-* -d '{"title" : "logstash-*", "timeFieldName": "@timestamp"}' – Aliza Jul 10 '16 at 20:00
2

In kibana:6.5.3 this can be achieved this calling the kibana api.

curl -X POST "http://localhost:5601/api/saved_objects/index-pattern/logstash" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "attributes": {
    "title": "logstash-*",
    "timeFieldName": "@timestamp"
  }
}
'

the Docs are here it does mention that the feature is experimental.

PB1
  • 117
  • 4