Execute Kibana savedsearch using curl command

[elborni96 (Mirko Bornivelli)]

Hi all,

i have create a new savedsearch on Kibana.

Now I need to use the curl command from my terminal to recall the results of this savedsearch.

The name of the savedsearch is :

S-Cert-Feed

How can i do this task? What is the sintax to invoke this savedsearch?

Best regards,
Mirko Bornivelli

[azasypkin]

Hi @elborni96,

Saved Searches are not supposed to be executed outside of Kibana context. One option though, would be using CSV export like this via Copy POST URL:

Also you can open Inspect panel for the saved search and copy actual request from the Request tab to execute it directly against ES, but it's not scaleable. So yeah, it depends on what you're trying to achieve exactly.

Best,
Oleg

[elborni96 (Mirko Bornivelli)]

Hi @azasypkin

These are the output of my savedsearch:

I need to create a curl string from my terminal to get these results on json format.

It's possible?

Alternatively, can i use a curl string to get events from elasticsearch index?

Thanks,
Mirko

[azasypkin]

@elborni96

I need to create a curl string from my terminal to get these results on json format.
It's possible?

Not through Kibana API.

Alternatively, can i use a curl string to get events from elasticsearch index?

Yeah, of course, if you know the query and have access to the ES instance you can get this data directly from ES. To get the query you can use Inspect for example:

[elborni96 (Mirko Bornivelli)]

@azasypkin

Thank you so much for the support.

Best regards,
Mirko Bornivelli