Creating Index Patterns and Dashboards Using API

[christng]

I'm using Kubernetes and trying to create index patterns and dashboards on Kibana 7.17 using the curl commands but they do not seem to be working. I've followed everything at these sources: Saved objects APIs | Kibana Guide [7.17] | Elastic and Index patterns APIs | Kibana Guide [7.17] | Elastic but nothing has worked.

Currently, I have this command:
curl "-XPOST" "/api/index_patterns/filebeat" "-H 'Content-Type: application/json' -d '{"attributes": {"title": "filebeat*", "timeFieldName": "@timestamp"}}'"

Can someone help with this?

[stephenb (Stephen Brown)]

Hi @christng

Think you need to look at this page you are missing some of the headers etc.
2nd always helpful to show the response error etc.. otherwise we are just guessing
3rd I assume you are actually putting the host and port into the API call.

REST API | Kibana Guide [7.17] | Elastic

Example

curl -X POST \
  http://localhost:5601/api/spaces/space \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: true' \
  -d '{
	"id": "sales",
	"name": "Sales",
	"description": "This is your Sales Space!",
	"disabledFeatures": []
}
'

[christng]

Thank you for your response. Currently, the helm chart I'm using has this command which successfully creates the watcher index pattern:

run_elastic_curl "-XPOST" "/api/saved_objects/_import" "@/etc/watcherConfig/watcher-index-pattern.ndjson"

But when I add my own command:
run_elastic_curl "-XPOST" "/api/index_patterns/filebeat" "-H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '{"attributes": {"title": "filebeat*", "timeFieldName": "@timestamp"}}'"

I get this error:
FAILED with response [{"statusCode":404,"error":"Not Found","message":"Not Found"}404]

Am I missing something?

[stephenb (Stephen Brown)]

Hi @christng

I am not familiar with run_elastic_curl

However you do not have correct syntax for the create index pattern body see here

You have an attributes top field etc... not correct.

Here is a working version

curl --location --request POST 'http://localhost:5601/api/index_patterns/index_pattern' \
--header 'Content-Type: application/json' \
--header 'kbn-xsrf: true' \
--data-raw '{
    "override":false,
    "refresh_fields":true,
    "index_pattern":{
        "title": "test",
        "timeFieldName": "@timestamp"
    }
}'

or shorthand

curl -X POST  'http://localhost:5601/api/index_patterns/index_pattern' \
-H 'Content-Type: application/json' \
-H 'kbn-xsrf: true' \
-d '{
    "override":false,
    "refresh_fields":true,
    "index_pattern":{
        "title": "test-3",
        "timeFieldName": "@timestamp"
    }
}'