Changing the default timestamp after creating index pattern

[Akshay_Singhvi]

I have a dataset with 4 different timestamp columns and other metrics.I have set all of them(time based columns) in date-time format and loaded it into elasticsearch.While creating its index-pattern I chose 1 of these timestamps as default and created my index pattern and rest of visualization were created with the same.

Now I want to change the default timestamp from the chosen one to another one from the list of 4 timestamps that were loaded earlier.Is there a way to do it? I want all the visulization to be plotted based on the newly selected timestamp instead of previous one without needing to reload the data.

[christophilus (Chris Davies)]

This is not supported first-class by Kibana, but you can, if you want to, manipulate anything by modifying what's stored in Elasticsearch. This, of course, takes you outside of what we officially support, and you stand a much higher chance of causing unforeseen problems.

Anyway, if you want to change the field that an index pattern uses, you must first find the ID of the index pattern, and the name of the field. In my local instance, my index pattern's ID was "index-pattern:e80d87d0-997e-11e8-8b82-9d827cd4cfa4", and the field I wanted it to use was "alttime". The following script updated the index pattern to use that field:

POST /.kibana/doc/index-pattern:e80d87d0-997e-11e8-8b82-9d827cd4cfa4/_update
{
  "script": {
    "lang": "painless",
    "source": "ctx._source['index-pattern'].timeFieldName = 'alttime'"
  }
}

However, I still had to go into my visualizations and tweak them, as they were raising errors after I made this change.

So, in short, move forward at your own risk, here!