# Create Elasticsearch query from Kibana saved search

**URL:** https://discuss.elastic.co/t/create-elasticsearch-query-from-kibana-saved-search/310459
**Category:** Kibana
**Tags:** elastic-stack-reporting
**Created:** [July 23, 2022, 4:39pm UTC](https://discuss.elastic.co/t/create-elasticsearch-query-from-kibana-saved-search/310459 "2022-07-23T16:39:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![kielni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kielni/32/84659_2.png) [@kielni](https://discuss.elastic.co/u/kielni)
#### Post date: [July 23, 2022, 4:39pm UTC](https://discuss.elastic.co/t/create-elasticsearch-query-from-kibana-saved-search/310459/1 "2022-07-23T16:39:57Z")

</div>

My goal is to use a Kibana saved search to get data out of Elasticsearch. I know about the reporting feature, but it's a pain to have to wait for a CSV, download it and re-upload it every time.

I can get my saved search object via `/api/saved_objects/search/{obj_id}`. The contents of `result["attributes"]["kibanaSavedObjectMeta"]["searchSourceJSON"]` looks related:

```auto
{
  "query": {
    "query": "",
    "language": "kuery"
  },
  "filter": [
    {
      "meta": {
        "negate": true,
        "type": "phrase",
        "key": "issue_type",
        "value": "bill gap",
        "params": {
          "query": "bill gap"
        },
        "disabled": false,
        "alias": null,
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index"
      },
      "query": {
        "match": {
          "issue_type": {
            "query": "bill gap",
            "type": "phrase"
          }
        }
      },
      "$state": {
        "store": "appState"
      }
    }
  ],
  "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
}

```

From Kibana, the Inspect / Requests panel shows this query:

```auto
{
  "version": true,
  "size": 500,
  "sort": [
    {
      "meter": {
        "order": "asc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "time": {
              "format": "strict_date_optional_time",
              "gte": "2022-07-22T15:32:00.910Z",
              "lte": "2022-07-23T15:32:00.910Z"
            }
          }
        }
      ],
      "filter": [
        {
          "match_all": {}
        }
      ],
      "should": [],
      "must_not": [
        {
          "match_phrase": {
            "issue_type": {
              "query": "bill gap"
            }
          }
        }
      ]
    }
  }
}

```

The Inspect query has a sort section, and a `bool` query with a date range and `must_not` section. The sort and date range aren't in `searchSourceJSON`. The filter condition (`"issue_type": { "query": "bill gap", "type": "phrase" }` ) looks similar, but the structure is different.

I found [Retrieving results by using kibanaSavedObjectMeta.searchSourceJSON from a saved search](https://discuss.elastic.co/t/retrieving-results-by-using-kibanasavedobjectmeta-searchsourcejson-from-a-saved-search/189464) ; it says to "re-execute the searches using the same parameters", but the saved object parameters don't work as an Elasticsearch query as-is.

How can I use the `searchSourceJSON` to create an Elasticsearch query equivalent to what I see in Kibana / Inspect? Is there a general way to do this, or any documentation on the format of `searchSourceJSON`?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2022, 4:40pm UTC](https://discuss.elastic.co/t/create-elasticsearch-query-from-kibana-saved-search/310459/2 "2022-08-20T16:40:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
