# CLI for creating index-pattens in .kibana in 6.2.x

**URL:** <https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361>\
**Category:** Kibana\
**Created:** [February 11, 2018, 2:48am UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361 "2018-02-11T02:48:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![parky118](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parky118/32/27624_2.png) [@parky118](https://discuss.elastic.co/u/parky118)\
**Post date:** [February 11, 2018, 2:48am UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361/1 "2018-02-11T02:48:56Z")

</div>

Previously in 5.1.2 we used to use the following cURL commands to programmatically create the default index and other indexes within Kibana:

curl -XPUT [http://localhost:9200/.kibana/index-pattern/\*](http://localhost:9200/.kibana/index-pattern/*) -d '{"title":"_", "timeFieldName":"time"}'  
curl -XPUT [http://localhost:9200/.kibana/config/5.1.2](http://localhost:9200/.kibana/config/5.1.2) -d '{"defaultIndex":"_"}'  
curl -XPUT [http://localhost:9200/.kibana/index-pattern/mantiswf](http://localhost:9200/.kibana/index-pattern/mantiswf) -d '{"title":"mantiswf", "timeFieldName":"time"}'

How can I do that within 6.2.X?

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [February 11, 2018, 8:34am UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361/2 "2018-02-11T08:34:24Z")

</div>

As of sometime around 5.6 Kibana has its own API for saved objects, including Index Patterns. It is not yet documented, so you have to scrape the how-to from the GitHub tickets that discuss the API.

The following examples are for an Index Pattern with an ID of `elastiflow-*`.

To fetch an index pattern...

```auto
curl -XGET -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/index-pattern/elastiflow-*

```

The output will look something like this...

```auto
{
	"id": "elastiflow-*",
	"type": "index-pattern",
	"updated_at": "2018-02-11T07:23:29.146Z",
	"version": 2,
	"attributes": {
		"title": "elastiflow-*",
		"timeFieldName": "@timestamp",
		"notExpandable": true,
		"fields": "[{\"name\":\"flow.bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
		"fieldFormatMap": "{\"flow.dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.bytes\":{\"id\":\"bytes\"}}"
	}
}

```

To import you need only the `attributes` section (you will get an error otherwise). So strip out the unneeded bits so you have this...

```auto
{
	"attributes": {
		"title": "elastiflow-*",
		"timeFieldName": "@timestamp",
		"notExpandable": true,
		"fields": "[{\"name\":\"flow.bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.dst_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"flow.src_port\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
		"fieldFormatMap": "{\"flow.dst_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.src_port\":{\"id\":\"number\",\"params\":{\"pattern\":\"0\"}},\"flow.bytes\":{\"id\":\"bytes\"}}"
	}
}

```

Save this to a file (for the example it is saved to `elastiflow.index_pattern.json`) and run the following command to import the index pattern.

```auto
curl -XPOST -u USERNAME:PASSWORD http://KIBANASERVER:5601/api/saved_objects/index-pattern/elastiflow-* -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @/PATH/TO/elastiflow.index_pattern.json

```

I hope that helps.

Rob

---

<div class="post-metadata">

**Author:** ![parky118](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parky118/32/27624_2.png) [@parky118](https://discuss.elastic.co/u/parky118)\
**Post date:** [February 12, 2018, 4:10pm UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361/3 "2018-02-12T16:10:08Z")

</div>

Thank Robert! I tried your command and I had to put the actual index ID as opposed to the name (elastiflow-\*). Once I did that, it works.

One additional question, how do I make an index a default index?

Thanks,

Craig

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [February 12, 2018, 4:42pm UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361/4 "2018-02-12T16:42:10Z")

</div>

Sorry, that was what I meant when I said my example was `elastiflow-`. I should have mentioned that you need to replace that with your own ID.

I don't know whether it is possible to specify the default index via the API. I haven't dug around for that yet. Hopefully some docs will be created soon that will remove some of the mystery.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2018, 4:42pm UTC](https://discuss.elastic.co/t/cli-for-creating-index-pattens-in-kibana-in-6-2-x/119361/5 "2018-03-12T16:42:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
