How to search visualizations that use a specific index pattern

Elastic Stack Kibana
1

Good morning

I would like to check which Visualizations on kibana are using a certain index pattern. I am trying to query it on .kibana indice but I'am doing something wrong. I am running the query on DevTools of Kibana:

GET /.kibana/_search
{
"query" : {
"match" : { "kibanaSavedObjectMeta.searchSourceJSON.index": "imap-cxp-*" }
}
}

THe query above returns o Objects, but it was supposed to return something because matching just by _type: "visualization" One of the records returned as we can see below:

  {
    "_index": ".kibana",
    "_type": "visualization",
    "_id": "0c62a2a0-34c2-11e7-871a-37e0d55ebfb9",
    "_score": 1,
    "_source": {
      "title": "GazlinuxLogs - Falha envio Hostopia",
      "visState": """{"title":"GazlinuxLogs - Falha envio","type":"metric","params":{"handleNoResults":true,"fontSize":60},"aggs":[{"id":"1","enabled":true,"type":"count","schema":"metric","params":{"customLabel":"Erro envio"}}],"listeners":{}}""",
      "uiStateJSON": "{}",
      "description": "",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": """{"index":"imap-cxp-*","query":{"query_string":{"query":"subject: (+\"ERRO ao tentar enviar\")","analyze_wildcard":true}},"filter":[]}"""
      }
    }
  },

Thanks for the attention

Regards

Alexandre

1 Like
2

That field kibanaSavedObjectMeta.searchSourceJSON is stored as a string, so you would need to do a prefix query. Pretty sure this will work:
GET .kibana/_search
{
"query": {
"prefix": {
"kibanaSavedObjectMeta.searchSourceJSON": {
"value": "{\"index\":\"imap-cxp-*\""
}
}
}
}

3

Discuss is mangling the formatting, sorry about that.

4

I've tried with your suggestion but it didn't work:

GET .kibana/_search
{
"query": {
"prefix": {
"kibanaSavedObjectMeta.searchSourceJSON": {
"value": "{"index":"imap-cxp-*""
}
}
}
}

The result is:

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": 0,
"max_score": null,
"hits":
}
}

Let me show you the complete json of a query that get just one record based on its _id and type:

GET /.kibana/_search
{
"query" : {
"bool": {
"must": [
{"term" : { "_type": "visualization" }},
{"term" : { "_id": "f85a92a0-34c0-11e7-871a-37e0d55ebfb9" }}
]
}
}
}

The result is:

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 2,
"hits": [
{
"_index": ".kibana",
"_type": "visualization",
"_id": "f85a92a0-34c0-11e7-871a-37e0d55ebfb9",
"_score": 2,
"_source": {
"title": "GazlinuxLogs - Recorredor",
"visState": """{"title":"GazlinuxLogs - Recorredor","type":"metric","params":{"handleNoResults":true,"fontSize":60},"aggs":[{"id":"1","enabled":true,"type":"count","schema":"metric","params":{"customLabel":"Recorredor"}}],"listeners":{}}""",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": """{"index":"imap-cxp-*","query":{"query_string":{"query":"subject: Sistema Recorredor","analyze_wildcard":true}},"filter":}"""
}
}
}
]
}
}

5

Is there a documentation that I can check to try to perform this query?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.