Find all the saved objects for a given tag

[dao (olivier hodac)]

Hello,

I try to call a REST request to get all the saved objects tagged with a given tag FS. I'd like to call something like

GET api/kibana/management/saved_objects/_find?type=dashboard&search_fields=tag&search=FS

It does not returns anything, even if this one returns a dashboard, which is tagged with FS

api/saved_objects/_find?type=dashboard&search_fields=title&search=RUNS

There are some examples where you can use this parameter to the URL &hasReference=%5B%7B%22type%22%3A%22tag%22%2C%22id%22%3A%2233c9ecf0-9880-11ec-9ed3-9f11b117f7f7%22%7D%5D

which is more complicated as it requires to use the ID of the tag, it means a pre request...

thank's

[jsanz (Jorge Sanz)]

I don't think there is a way to search for tag objects based on its name. As you already saw, and per documentation, you need to use the has_reference parameter with the (encoded) payload:

[
  {
    "type":"tag",
    "id":"tag-long-identifier"
  }
]

So to check the API I added the test1 tag to a few objects in a clean instance with sample data:

First to get the test1 identifier search filtering for its name:

TAG_ID=$(curl --silent "http://localhost:5603/api/saved_objects/_find?type=tag&search=test1" | jq -r ".saved_objects[].id")

Put all saved object types in a variable to make the final command a bit easier to read:

TYPES_PARAMS="type=config&type=url&type=index-pattern&type=query&type=tag&type=action&type=alert&type=graph-workspace&type=visualization&type=canvas-element&type=canvas-workpad&type=dashboard&type=map&type=lens&type=cases&type=search&type=osquery-saved-query&type=osquery-pack&type=uptime-dynamic-settings&type=infrastructure-ui-source&type=metrics-explorer-view&type=inventory-view&type=apm-indices"

Now you can use use both variables in a final request:

$ curl --silent "http://localhost:5603/api/saved_objects/_find?${TYPES_PARAMS}&has_reference=%5B%7B%22type%22%3A%22tag%22%2C%22id%22%3A%22${TAG_ID}%22%7D%5D" | \
  jq -c ".saved_objects[].attributes.title"
"Test lens"
"[Flights] Delays & Cancellations"
"[Flights] Delay Buckets"