Configure Kibana Log UI settings per space using API

[leon.seng]

Hi,

I am currently running Kibanamultiple spaces - each monitoring for different index patterns, in order the trigger alerts and actions on different indices.

This page on Logs UI settings shows how we can configure the default configuration for Kibana Logs.

Is it possible to configure it on a per space basis? I was hoping to automate this process instead of configuring it through the web UI.

Thanks

[afgomez (Alejandro Fernández Gómez)]

Hi @leon.seng, welcome to elastic!

The kibana log UI settings are stored in a saved object. There is an experimental API you can use to create the right configuration for each space.

POST <kibana host>:<port>/s/<space_id>/api/saved_objects/<type>/<id>

For the logs UI settings, the <type> of the saved object is "infrastructure-ui-source" and the <id> is "default".

In your request add a logAlias attribute with the value that you want.

$ curl -X POST http://your-kibana.example.com/s/<space_id>/api/saved_objects/infrastructure-ui-source/default  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
{
  "attributes": {
    "logAlias": "es-index-*"
  }
}'

Take into account that this API is experimental and might change in future releases.

Let me know if it worked for you!

[leon.seng]

Thanks! That worked for me. Is there documentation on getting all Alerts within a space too? This is what worked for me to retrieve ONE Alert by ID

GET <kibana host>:<port>/s/<space_id>/api/saved_objects/alert/<id>

But how do I figure out what the Alert ID is beforehand.

[afgomez (Alejandro Fernández Gómez)]

Is there documentation on getting all Alerts within a space too?

I checked with the alerts team. There is a non-public API documented here, but the API is not stable (that's why is not public yet) and its interface can change at any time, so take that into account

[leon.seng]

Thank you