# How do you set default index with x-pack installed?
**URL:** https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018
**Category:** Kibana
**Created:** [November 24, 2017, 11:26am UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018 "2017-11-24T11:26:00Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 24, 2017, 11:26am UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/1 "2017-11-24T11:26:00Z")
Hi,
Without X-Pack I can set default index with the following curl command:
curl --verbose -POST [http://kibana:5601/api/saved\_objects/index-pattern](http://kibana:5601/api/saved_objects/index-pattern) -H "kbn-version: $KIBANA\_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, _/_' -H 'DNT:1' -d '{"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}'
I tried the same with X-Pack installed and it does not work.
I also tried the following but it does not change the index:
> curl --verbose -XPOST [http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex](http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex) -H 'kbn-version:5.6.3' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/json' -H 'kbn-name:kibana' -d '{"value":"events-\*"}'
>
> Note: Unnecessary use of -X or --request, POST is already inferred.
>
> - Trying 10.68.32.177...
> - TCP\_NODELAY set
> - Connected to kibana (10.68.32.177) port 5601 (#0)
> - Server auth using Basic with user 'ericsson'
>
> > POST /api/kibana/settings/defaultIndex HTTP/1.1
> > Host: kibana:5601
> > Authorization: Basic ZXJpY3Nzb246ZXJpY3Nzb24=
> > Accept: _/_
> > kbn-version:5.6.3
> > User-Agent: Mozilla
> > Content-Type: application/json
> > kbn-name:kibana
> > Content-Length: 20
>
> - upload completely sent off: 20 out of 20 bytes
> \< HTTP/1.1 200 OK
> \< kbn-name: kibana
> \< kbn-version: 5.6.3
> \< kbn-xpack-sig: 1028c92db5fd0f241c63cccd5da55232
> \< content-type: application/json; charset=utf-8
> \< cache-control: no-cache
> \< content-length: 153
> \< Date: Fri, 24 Nov 2017 11:19:11 GMT
> \< Connection: keep-alive
> \<
> - Connection #0 to host kibana left intact
> {"settings":{"defaultIndex":{"userValue":"events-\*"},"xPackMonitoring:allowReport":{"userValue":false},"xPackMonitoring:showBanner":{"userValue":false}}}
How to use curl and change default-index?
Br Mathias
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [November 24, 2017, 12:27pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/2 "2017-11-24T12:27:48Z")
does this help you ? [https://www.elastic.co/guide/en/x-pack/current/http-clients.html](https://www.elastic.co/guide/en/x-pack/current/http-clients.html)
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 24, 2017, 12:33pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/3 "2017-11-24T12:33:25Z")
Not really,
I have created a user with password which I can log into Kibana with.
I am creating documents and store them in elasticsearch using the same credentials.
An I can retrieve the documents as well.
What I can not do is to set the default index at startup of kibana.
Setting it manually via the gui works but that does not help me.
I want it configured at start.
Is it possible to curl in the default index?
What headers and data are required?
curl -XPOST [http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex](http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex) ........
Anything else I need to do?
Kind regards
Mathias
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [November 24, 2017, 12:45pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/4 "2017-11-24T12:45:46Z")
providing username and password with `curl --user username:password` also does not work ?
whats the response from
```auto
curl --verbose --user username:password -POST http://kibana:5601/api/saved_objects/index-pattern -H "kbn-version: $KIBANA_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, /' -H 'DNT:1' -d '{"attributes":{"title":"events-*","timeFieldName":"@timestamp","notExpandable":true}}'
```
?
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 24, 2017, 12:53pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/5 "2017-11-24T12:53:52Z")
> [@ppisljar](#):
>
> curl --verbose --user username:password -POST [http://kibana:5601/api/saved\_objects/index-pattern](http://kibana:5601/api/saved_objects/index-pattern) -H "kbn-version: $KIBANA\_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, /' -H 'DNT:1' -d '{"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}'
The command executes without problems:
- Trying 10.68.32.177...
- TCP\_NODELAY set
- Connected to kibana (10.68.32.177) port 5601 (#0)
- Server auth using Basic with user 'ericsson'
> POST /api/saved\_objects/index-pattern HTTP/1.1
> Host: kibana:5601
> Authorization: Basic ZXJpY3Nzb246ZXJpY3Nzb24=
> kbn-version: 5.6.3
> Content-Type: application/json;charset=UTF-8
> User-Agent: Mozilla/5.0
> Accept: Application/json, text/plain, /
> DNT:1
> Content-Length: 85
- upload completely sent off: 85 out of 85 bytes
\< HTTP/1.1 200 OK
\< kbn-name: kibana
\< kbn-version: 5.6.3
\< kbn-xpack-sig: 1028c92db5fd0f241c63cccd5da55232
\< content-type: application/json; charset=utf-8
\< cache-control: no-cache
\< content-length: 148
\< Date: Fri, 24 Nov 2017 12:47:46 GMT
\< Connection: keep-alive
\<
- Connection #0 to host kibana left intact
{"id":"AV\_uEc\_V2io\_oD0oo2If","type":"index-pattern","version":1,"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}
But when doublechecking in gui, I do not see that default index has updated to events-\*.
Instead the old default index is no longer default:
I manually have to create a new one:
Br Mathias
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [November 24, 2017, 1:05pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/6 "2017-11-24T13:05:36Z")
ok thats weird ... i'll ask somebody to look into this
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [November 27, 2017, 4:38pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/7 "2017-11-27T16:38:01Z")
Hi @mathias,
I'm not sure I'm quite following.
I don't think there is any code in Kibana server that will automatically set a default index pattern. We do, however, have code in Kibana client that _will_ do that.
Two sources:
1. After creating an index pattern in the UI: [https://github.com/elastic/kibana/blob/6.0/src/core\_plugins/kibana/public/management/sections/indices/create\_index\_pattern/create\_index\_pattern.js#L221](https://github.com/elastic/kibana/blob/6.0/src/core_plugins/kibana/public/management/sections/indices/create_index_pattern/create_index_pattern.js#L221)
2. After loading Kibana when there is no default set, but an index pattern exists: [https://github.com/elastic/kibana/blob/6.0/src/ui/public/index\_patterns/route\_setup/load\_default.js#L36](https://github.com/elastic/kibana/blob/6.0/src/ui/public/index_patterns/route_setup/load_default.js#L36) (Keep in mind that this code path is only invoked if there is only one existing index pattern)
> [@mathias](#):
>
> Without X-Pack I can set default index with the following curl command:
>
> curl --verbose -POST [http://kibana:5601/api/saved\_objects/index-pattern](http://kibana:5601/api/saved_objects/index-pattern) -H "kbn-version: $KIBANA\_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, /' -H 'DNT:1' -d '{"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}'
Are you sure that a default index pattern is created after this curl command, and not after loading Kibana? You can easily verify by removing all existing index patterns, running this curl command, then running:
`curl -XGET localhost:5601/api/kibana/settings` and see if you see the `defaultIndex` field.
Thanks,
Chris
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 28, 2017, 8:42am UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/8 "2017-11-28T08:42:38Z")
> [@chrisronline](#):
>
> curl -XGET localhost:5601/api/kibana/settings
Before I try to set default index it looks like this:
> curl -s -XGET user:pass@kibana:5601/api/kibana/settings | jq .
> {
> "settings": {
> "buildNum": {
> "userValue": 15554
> },
> "xPackMonitoring:allowReport": {
> "userValue": true
> },
> "xPackMonitoring:showBanner": {
> "userValue": false
> }
> }
> }
An index pattern exists:
> curl --silent --head '[http://user:pass@localhost:5601/api/index\_patterns/\_fields\_for\_wildcard?pattern=events-](http://user:pass@localhost:5601/api/index_patterns/_fields_for_wildcard?pattern=events-)\*'
> HTTP/1.1 200 OK
> kbn-name: kibana
> kbn-version: 5.6.3
> kbn-xpack-sig: 1028c92db5fd0f241c63cccd5da55232
> content-type: application/json; charset=utf-8
> cache-control: no-cache
> Date: Tue, 28 Nov 2017 08:23:42 GMT
> Connection: keep-alive
The GUI looks like this:
Before loading the X-Pack I managed to set default index this way:
Maybe it was pure luck but it worked every time.
> curl --verbose -POST [http://user:pass@kibana:5601/api/saved\_objects/index-pattern](http://user:pass@kibana:5601/api/saved_objects/index-pattern) -H "kbn-version: $KIBANA\_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, _/_' -H 'DNT:1' -d '{"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}'
After loading X-pack it looks like this:
> curl --verbose -POST [http://user:pass@kibana:5601/api/saved\_objects/index-pattern](http://user:pass@kibana:5601/api/saved_objects/index-pattern) -H "kbn-version: $KIBANA\_VERSION" -H 'Content-Type: application/json;charset=UTF-8' -H 'User-Agent: Mozilla/5.0' -H 'Accept: Application/json, text/plain, _/_' -H 'DNT:1' -d '{"attributes":{"title":"events-\*","timeFieldName":"@tim
> estamp","notExpandable":true}}'
>
> - Trying 10.68.32.177...
> - TCP\_NODELAY set
> - Connected to kibana (10.68.32.177) port 5601 (#0)
> - Server auth using Basic with user 'user'
>
> > POST /api/saved\_objects/index-pattern HTTP/1.1
> > Host: kibana:5601
> > Authorization: Basic ZXJpY3Nzb246ZXJpY3Nzb24=
> > kbn-version: 5.6.3
> > Content-Type: application/json;charset=UTF-8
> > User-Agent: Mozilla/5.0
> > Accept: Application/json, text/plain, _/_
> > DNT:1
> > Content-Length: 85
>
> - upload completely sent off: 85 out of 85 bytes
> \< HTTP/1.1 200 OK
> \< kbn-name: kibana
> \< kbn-version: 5.6.3
> \< kbn-xpack-sig: 1028c92db5fd0f241c63cccd5da55232
> \< content-type: application/json; charset=utf-8
> \< cache-control: no-cache
> \< content-length: 148
> \< Date: Tue, 28 Nov 2017 08:32:21 GMT
> \< Connection: keep-alive
> \<
> - Connection #0 to host kibana left intact
> {"id":"AWABwWq42io\_oD0oyceB","type":"index-pattern","version":1,"attributes":{"title":"events-\*","timeFieldName":"@timestamp","notExpandable":true}}/ #
> / #
> / #
> / #
> / #
> / # curl -s -XGET user:pass@kibana:5601/api/kibana/settings | jq .
> {
> "settings": {
> "buildNum": {
> "userValue": 15554
> },
> "xPackMonitoring:allowReport": {
> "userValue": true
> },
> "xPackMonitoring:showBanner": {
> "userValue": false
> }
> }
> }
Another index pattern is created but no default index pattern.
I tried to see what the GUI send when setting default index pattern.
> curl --verbose -XPOST [http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex](http://user:pwd@kibana:5601/api/kibana/settings/defaultIndex) -H 'kbn-version:5.6.3' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/json' -H 'kbn-name:kibana' -d '{"value":"events-\*"}'
> Note: Unnecessary use of -X or --request, POST is already inferred.
>
> - Trying 10.68.32.177...
> - TCP\_NODELAY set
> - Connected to kibana (10.68.32.177) port 5601 (#0)
> - Server auth using Basic with user 'user'
>
> > POST /api/kibana/settings/defaultIndex HTTP/1.1
> > Host: kibana:5601
> > Authorization: Basic ZXJpY3Nzb246ZXJpY3Nzb24=
> > Accept: _/_
> > kbn-version:5.6.3
> > User-Agent: Mozilla/5.0
> > Content-Type: application/json
> > kbn-name:kibana
> > Content-Length: 20
>
> - upload completely sent off: 20 out of 20 bytes
> \< HTTP/1.1 200 OK
> \< kbn-name: kibana
> \< kbn-version: 5.6.3
> \< kbn-xpack-sig: 1028c92db5fd0f241c63cccd5da55232
> \< content-type: application/json; charset=utf-8
> \< cache-control: no-cache
> \< content-length: 183
> \< Date: Tue, 28 Nov 2017 08:39:25 GMT
> \< Connection: keep-alive
> \<
> - Connection #0 to host kibana left intact
> {"settings":{"buildNum":{"userValue":15554},"xPackMonitoring:allowReport":{"userValue":true},"xPackMonitoring:showBanner":{"userValue":false},"defaultIndex":{"userValue":"events-_"}}}/ #
> / #
> / #
> / #
> / #
> / # curl -s -XGET user:pass@kibana:5601/api/kibana/settings | jq .
> {
> "settings": {
> "buildNum": {
> "userValue": 15554
> },
> "xPackMonitoring:allowReport": {
> "userValue": true
> },
> "xPackMonitoring:showBanner": {
> "userValue": false
> },
> "defaultIndex": {
> "userValue": "events-_"
> }
> }
> }
But the GUI looks the same. No index pattern is set:
Just noticed that after setting the default index in GUI the last curl command changes to an id instead of a name.
> curl -s -XGETuser:pass@kibana:5601/api/kibana/settings | jq .
> {
> "settings": {
> "buildNum": {
> "userValue": 15554
> },
> "xPackMonitoring:allowReport": {
> "userValue": true
> },
> "xPackMonitoring:showBanner": {
> "userValue": false
> },
> "defaultIndex": {
> "userValue": **"AWABwWq42io\_oD0oyceB**"
> }
> }
> }
Br Mathias
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 28, 2017, 10:43am UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/9 "2017-11-28T10:43:23Z")
> [@mathias](#):
>
> curl -s -XGETuser:pass@kibana:5601/api/kibana/settings | jq .
Without X-Pack it looks like this when I have a working default index set with the first curl command above:
> curl -s -XGET kibana:5601/api/kibana/settings | jq .
> {
> "settings": {
> "defaultIndex": {
> "userValue": "events-\*"
> },
> "metrics:max\_buckets": {
> "userValue": "300000"
> }
> }
> }
Br Mathias
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [November 28, 2017, 4:02pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/10 "2017-11-28T16:02:43Z")
Hi @mathias,
Which version of Kibana are you running in both situations, the one with X-Pack and the one without?
Thanks,
Chris
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 28, 2017, 7:21pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/11 "2017-11-28T19:21:49Z")
Hi Chris,
Kibana 5.6.3 in both cases.
The only major difference is that I use an alpine docker image for the non x-pack case.
When using x-pack I was forced to use debian docker image.
Br Mathias
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [November 28, 2017, 8:39pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/12 "2017-11-28T20:39:07Z")
Hi @mathias,
Sorry for the back and forth. I just want to make sure I'm using the right steps in reproducing this.
On a fresh install of 5.6.3, this is what I'm doing:
1. Starting ES
2. Starting Kibana (and not loading Kibana in the browser)
3. Verifying no default index pattern:
```auto
curl -XGET /api/kibana/settings
->
{"settings":{"buildNum":{"userValue":8467}}}
```
1. Creating an index pattern:
```auto
curl -XPOST /api/saved_objects/index-pattern -H 'kbn-version: 5.6.3' -H 'Content-Type: application/json' -d '{"attributes":{"title": "logstash-*", "timeFieldName": "@timestamp", "notExpandable": true}}'
```
1. Verifying it exists:
```auto
curl -XGET /api/saved_objects/index-pattern
->
{"saved_objects":[{"id":"AWAEVmfI_cDw8Ov6vitD","type":"index-pattern","version":1,"attributes":{"title":"logstash-*","timeFieldName":"@timestamp","notExpandable":true}}],"total":1,"per_page":20,"page":1}
```
1. Checking for a default index:
```auto
curl -XGET /api/kibana/settings
->
{"settings":{"buildNum":{"userValue":8467}}}
```
Am I correct in assuming that you're saying that step 4 actually creates the default index pattern and you'd see it in step 6?
---
### Author:  [@mathias](https://discuss.elastic.co/u/mathias)
#### Post date: [November 28, 2017, 8:42pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/13 "2017-11-28T20:42:57Z")
Yes, that is correct.
I used inspect inside the browser to see what what sent when I set default index from the GUI.
I did the same thing using curl and it worked.
Br Mathias
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [November 28, 2017, 9:18pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/14 "2017-11-28T21:18:04Z")
> [@mathias](#):
>
> I used inspect inside the browser to see what what sent when I set default index from the GUI.
>
> I did the same thing using curl and it worked.
Oh, so if I understand this correctly, you're saying that you did an extra curl command? Specifically the one you found that the browser made to set the default index?
Assuming that's true, you're saying that these steps work fine without x-pack but not with it, right?
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [November 28, 2017, 9:47pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/15 "2017-11-28T21:47:23Z")
I think the core problem is that you're using the index pattern title instead of the id. That changed in 5.6. Instead of posting `-d '{"value": "events-*"}'`, try using the index pattern id, which you can see from the `/saved_objects/index-pattern` endpoint.
However, this behavior should be consistent between x-pack and non x-pack
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 26, 2017, 9:47pm UTC](https://discuss.elastic.co/t/how-do-you-set-default-index-with-x-pack-installed/109018/16 "2017-12-26T21:47:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.