CLI for creating index-pattens in .kibana in 6.2.x

Elastic Stack Kibana
1

Previously in 5.1.2 we used to use the following cURL commands to programmatically create the default index and other indexes within Kibana:

curl -XPUT http://localhost:9200/.kibana/index-pattern/* -d '{"title":"", "timeFieldName":"time"}'
curl -XPUT http://localhost:9200/.kibana/config/5.1.2 -d '{"defaultIndex":""}'
curl -XPUT http://localhost:9200/.kibana/index-pattern/mantiswf -d '{"title":"mantiswf", "timeFieldName":"time"}'

How can I do that within 6.2.X?

2

As of sometime around 5.6 Kibana has its own API for saved objects, including Index Patterns. It is not yet documented, so you have to scrape the how-to from the GitHub tickets that discuss the API.

The following examples are for an Index Pattern with an ID of elastiflow-*.

To fetch an index pattern...

curl -XGET -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/index-pattern/elastiflow-*

The output will look something like this...

{
	"id": "elastiflow-*",
	"type": "index-pattern",
	"updated_at": "2018-02-11T07:23:29.146Z",
	"version": 2,
	"attributes": {
		"title": "elastiflow-*",
		"timeFieldName": "@timestamp",
		"notExpandable": true,
		"fields": "[{\"name\":\"flow.bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
		"fieldFormatMap": "{\"flow.dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.bytes\":{\"id\":\"bytes\"}}"
	}
}

To import you need only the attributes section (you will get an error otherwise). So strip out the unneeded bits so you have this...

{
	"attributes": {
		"title": "elastiflow-*",
		"timeFieldName": "@timestamp",
		"notExpandable": true,
		"fields": "[{\"name\":\"flow.bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
		"fieldFormatMap": "{\"flow.dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.bytes\":{\"id\":\"bytes\"}}"
	}
}

Save this to a file (for the example it is saved to elastiflow.index_pattern.json) and run the following command to import the index pattern.

curl -XPOST -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/index-pattern/elastiflow-* -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @/PATH/TO/elastiflow.index_pattern.json

I hope that helps.

Rob

1 Like
3

Thank Robert! I tried your command and I had to put the actual index ID as opposed to the name (elastiflow-*). Once I did that, it works.

One additional question, how do I make an index a default index?

Thanks,

Craig

4

Sorry, that was what I meant when I said my example was elastiflow-. I should have mentioned that you need to replace that with your own ID.

I don't know whether it is possible to specify the default index via the API. I haven't dug around for that yet. Hopefully some docs will be created soon that will remove some of the mystery.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.