How to create an index pattern in Opensearch using API?

Question

I want to create an index pattern using Opensearch API. I tried to replicate what could be made graphically in the following image window, using as index pattern name cwl-* and then as time field @timestamp. My domain has OpenSearch 1.2 installed.

Using curl (directly modifiend the command in kibana doc):

curl -u '****:*****' -X POST "https://******.eu-central-1.es.amazonaws.com/api/index_patterns/index_pattern" -H 'osd-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "index_pattern": {
     "title": "cwl-*",
     "timeFieldName": "@timestamp"
  }
}'

but I receive

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Rejecting mapping update to [api] as the final mapping would have more than 1 type: [_doc, index_patterns]"}],"type":"illegal_argument_exception","reason":"Rejecting mapping update to [api] as the final mapping would have more than 1 type: [_doc, index_patterns]"},"status":400}

@ErmiyaEskandary just the Fine-grained access control but it works because I don't have any problem in performing other requests... — Dresult, Apr 10 '22 at 16:01
@ErmiyaEskandary Unfortunately I had already tried, it says `{"statusCode":404,"error":"Not Found","message":"Not Found"}` — Dresult, Apr 10 '22 at 16:13
Your URL is somehow wrong - I don't have docs in front of me right now but try removing `_dashboards` from the URL and if that doesn't work, also remove `api` — Ermiya Eskandary, Apr 10 '22 at 16:17
@ErmiyaEskandary I tried to perform a login through curl storing a cookie, it seems to avoid the authentication failure but then I can't create the index pattern anyway (this could depend on the url provided). — Dresult, Apr 10 '22 at 16:47
Yes as your payload is wrong - read example provided here https://www.elastic.co/guide/en/kibana/master/index-patterns-api-create.html (hint: you need a `index_pattern` object) etc. — Ermiya Eskandary, Apr 10 '22 at 16:48
@ErmiyaEskandary Nothing. I've updated the question so it could be easier to be understand and reproduced with curl instead of python — Dresult, Apr 10 '22 at 17:45
Your question now seems to not be related to OpenSearch or AWS itself but more regarding Elasticsearch - I would add the regular `elasticsearch` tag to get views from Elasticsearch experts :) one step closer! — Ermiya Eskandary, Apr 10 '22 at 17:46

score 1 · Answer 1 · answered Apr 14 '22 at 08:33

1

curl -u '****:*****' -X POST "https://******.eu-central-1.es.amazonaws.com/api/index_patterns/cwl-*" -H 'osd-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "index_pattern": {
     "title": "cwl-*",
     "timeFieldName": "@timestamp"
  }
}'

change api/index_patterns/index_pattern to api/index_patterns/cwl-* and try again?

answered Apr 14 '22 at 08:33

doge76

21
2

It works in a sense that the command creates something but I cannot see anything among saved objects and seams that in this way only an index which name is "api" is created not an index pattern therefore each time I access the dashboard, once it finds data, it ask me if I want to create it. – Dresult Apr 15 '22 at 11:15
if you want the index-pattern to be global, try to add this attribute in header: securitytenant: "global"? – doge76 Apr 15 '22 at 12:03
already done, I've added -H 'securitytenant: global' to the curl string – Dresult Apr 15 '22 at 13:56
2

@Dresult Did you ever manage to figure this out? I am encountering the same issue, it seems. – Kasami Oct 10 '22 at 22:50

mgr110 · Answer 2 · 2022-12-16T13:09:01.987

0

It worked for me in OpenSearch 1.3 when I added an ID in the URI and used saved_objects instead of index_patterns.

So your cURL-request should work when looking like this.

curl -u '****:*****' -X POST "https://<opensearch-dashboards-host>.eu-central-1.es.amazonaws.com/api/saved_objects/index-pattern/<ID>" 
-H 'osd-xsrf: true' 
-H 'Content-Type: application/json' 
-d 
   '{
      "index_pattern": {
         "title": "cwl-*",
         "timeFieldName": "@timestamp"
      }
    }'

edited Dec 16 '22 at 13:09

answered Aug 25 '22 at 08:51

mgr110

1
1

I am getting `no handler found for uri [/api/saved_objects/index-pattern/cwl-*] and method [POST]` error for this.. using opensearch1.3. – K.Thanvi Dec 14 '22 at 17:09
1

@K.Thanvi This is probably because you are sending the request to the OpenSearch-host. The request is meant to be sent to the OpenSearch Dashboards-host (or Kibana-host if you use that). Using the Dev Tools will send the request to the OpenSearch-host. – mgr110 Dec 15 '22 at 11:44
1

Thanks! Yes that was the issue. i had to send the request to my `/_dashboards/api/saved_objects/index-pattern` endpoint. – K.Thanvi Jan 09 '23 at 17:07

How to create an index pattern in Opensearch using API?

2 Answers2