Change kibana index patterns to upgraded dashboards

[zakthan (Thanassis Zakopoulos)]

Does anybody know how can I migrate my old kibana saved objects from version 6.84 to version 7.5.1?

Actually I used to have some index patterns from filebeat6* filebeat indices and now that I have upgraded to 7* filebeat indices I do not know how to edit my saved objects.

I did the import/export procedure from Kibana UI but now I am confused how to edit (ideally bulk updated) my saved objects to have the correct IDs of the new index patterns (and any other change that need to be made).

Any ideas?

[Midas]

You have a couple of options. The best involves creating a JSON file of the visualizations. The transfer between Kibana UIs involves a saved JSON object of all index patterns, visualizations, dashboards, etc. You can go to your saved objects in your new environment, reduce it to just visualizations, and then export all of the saved visualization objects to a JSON file. Next, you will need to know the _id of the old index pattern and the _id of the new index pattern. You can find these usually in the .kibana* index pattern (just add it as a pattern) and look through the index ids in the Discover tab (or build a Kibana table of the same). Once you have this, just open that visualizations JSON in something like Notepad++ and do a find and replace. When done updating the objects in bulk, import that visualization JSON file back in to the environment and overwrite what was there. You may have to make a few changes here and there (I always forget something when I do this) but it should work.

Your other option is to do it all manually, one by one. I don't recommend this...still haunts me to this day (updated 800+ visualizations and saved searches manually once).

Hope that answers your question!

-Midas

[zakthan (Thanassis Zakopoulos)]

Actually I have finished my migration after solving a couple more issues that were pending.
As @Midas described this is the procedure more or less to migrate saved objects from v6 installation to v7.
I would also like to add some more challenges that I had to overcome:

• Even if I managed to import/export 150 saved objects from v6 to v7, when I tried to re-import the edited objects of v7 I was given an "Import saved objects Sorry, there was an error" message.
  In order to overcome that I exported objects and imported 50 at a time. That worked.
• Some fields at v7 index are different. For example beat.hostname is now agent.name and source is now log.file.path. I had to replace these fields in various places
• After fixing most of the saved objects I only exported problematic dashboards with their related objects and edited only these. That saved me a couple of times.
  Hope this will help people in the future.
  Cheers!