How to switch source of visualization? from index pattern to saved search?

Elastic Stack Kibana
1

Hi,

I made a mistake on creating my visualizations. I've accidently choosen an index pattern instead of a saved search.

My index changed and now the vis isn't getting any data. I think best way is to use a saved search instead than using an index pattern.

What is the best way to change it? If I create a new vis it will be a lot to do (many vis, embedded on many dashboards)

Are there any (performance) downsides when using saved search instead of index pattern?
In my saved searches are more flexible, but I want to know if i buy issues for this flexibility.

Thanks, Andreas

2

You can't switch the source on the fly, you'll have to recreate it. And if you change the index pattern that the saved search is based on, you'll have to fix that too. It's best to be aware of your index pattern uuids and reuse them when recreating the index pattern in order for the existing visualizations to point at it.

3

It's a pity.

If I recreate the visualizations. What is the easiest way to change the uuid?
I am thinking of:

  • create new vis (new uuid)
  • remove old vis
  • replace uuid of new vis with old (deleted) uuid

Than at least I only need to recreate the visualization and do not need to replace the vis on dashboards.

Is there any way to replace uuid in GUI or do I need to export the saved object, change uuid in text editor and import again?

4

You can't change the visualization UUID from the UI, you can only do it when exporting it. Hence why I recommended only doing it for index patterns.

5

I've done the job now by exporting, and adding / changing references, etc. via text editor and imported them back and changed to saved searches.

This is the most flexible because you can even change the used index patterns in an existing saved search via gui.

But it is a pity that kibana does not offer an internal option to change the reference via gui.
I found some feature requests about this in github, some are open for a few years now. :frowning:

6

It's not something we want to continue(the UUID and name difference) with and there are talks about making the saved objects easier to manage in the future. But this takes time and it wiil need a major version update since it's going to most likely be a breaking change.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.