Change visualization index under saved objects

[EZprogramming (Kourosh Azizi)]

I want to change my index for a visualization, so I went to:

Management > Saved Objects > Visualization

but I don't what field I have to change in my kibanaSavedObjectMeta.searchSourceJSON

kibanaSavedObjectMeta.searchSourceJSON:

{
  "query": {
    "query": "",
    "language": "kuery"
  },
  "filter": [
    {
      "$state": {
        "store": "appState"
      },
      "meta": {
        "alias": null,
        "disabled": false,
        "key": "cloudwatch_logs.log_group",
        "negate": false,
        "params": {
          "query": "/aws/lambda/b2_record_processor"
        },
        "type": "phrase",
        "value": "/aws/lambda/b2_record_processor",
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index"
      },
      "query": {
        "match": {
          "cloudwatch_logs.log_group": {
            "query": "/aws/lambda/b2_record_processor",
            "type": "phrase"
          }
        }
      }
    },
    {
      "meta": {
        "alias": null,
        "negate": false,
        "type": "phrase",
        "key": "message",
        "value": "ERROR - RECPROC - PROCESS",
        "params": {
          "query": "ERROR - RECPROC - PROCESS"
        },
        "disabled": false,
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index"
      },
      "query": {
        "match": {
          "message": {
            "query": "ERROR - RECPROC - PROCESS",
            "type": "phrase"
          }
        }
      },
      "$state": {
        "store": "appState"
      }
    }
  ],
  "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
}

[christophilus (Chris Davies)]

There's really no first-class support for switching the index that a visualization uses. We're working on it and hope to have a beta for something like this soon, but it's not in there, yet. Probably the best thing to do is to re-create the visualization with the appropriate index.

However if you really want to edit it, you can modify the "references" on the visualization to point to a different index pattern:

{"id":"ff959d40-b880-11e8-a6d9-e546fe2bba5f","name":"kibanaSavedObjectMeta.searchSourceJSON.index","type":"index-pattern"}

That's what my reference looks like on a sample visualization. If you change the "id" to whatever index pattern you want, you should effectively switch the index pattern associated with the visualization. But you may also break things. So, it's not recommended.

[EZprogramming (Kourosh Azizi)]

@christophilus, thanks for your clarification, I hope your team can release this feature asap because it makes the user's life much easier, but in the meantime that we are stuck with this older approach, I was wondering how do you know what id is associated with what index name?

Here are is my reference.

references:

[
  {
    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
    "type": "index-pattern",
    "id": "906f3b00-99e5-11e9-a677-f58a6457b295"
  },
  {
    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
    "type": "index-pattern",
    "id": "906f3b00-99e5-11e9-a677-f58a6457b295"
  },
  {
    "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index",
    "type": "index-pattern",
    "id": "906f3b00-99e5-11e9-a677-f58a6457b295"
  }
]

[EZprogramming (Kourosh Azizi)]

Found it, you can go to

Kibana > management > saved objects (filter index patterns) > export (you will see the _id of your index pattern in export.json file).

You can also do the same process and export the json files for each visualization and dashboard, change the name and ids of under references, and import the saved json file back to kibana. It will most likely replace the original visualizations because the visualizations share the same id. To have two different visualizations we have to have unique ids.