How do I use a different index for my visualisations?

[lostsoul352]

Hello I'm using elasticsearch v 5.6.16

I've created many visualiations based on an index called (say) "myindex", but now I want to import new data into a different index (it's a different customers data).

Is there any way I can easily re-use the visualisation I already have and simply alter the index being used?

[dadoonet (David Pilato)]

Easy? Not really. But may be you can "hack" a bit by exporting Kibana data to JSON (there is an option in Kibana for that), then modify the JSON and reimport it...

Anyway, I'm moving your question to #kibana so experts there may answer better.

[lostsoul352]

Hmm okay. I was really hoping there was a simpler way of doing this. I guess I could just put everything into a single index. In logstash I'm also capturing the directory path from where the data was imported as a field, so I guess I could use this to seperate the data.

[Juanma (Juan Manuel Nieto)]

Hello

You can do this in different ways. As @dadoonet said you can import/export the objects.

You also can edit the object and change the "index": field as in this image:

Or you can also delete the index field and assign it a search, which would make you easier to switch index-patterns on the future just changing the index pattern of the search in discover and saving it, but remember that both indices the older and the newer must have the same fields and mappings, if you have adopted ECS the switch with this method should be easier

To assign it a search you just have first to get searchid, for this open the search on discover and take it from the url as shown in the image:

And then in Kibana Saved Objects edit the visualization, remove the index field and add your id to the following field

I hope this helps