I am having an error importing dashboards. I was running old versions of the ELK Stack (5.5.2) and upgraded to 5.6.1. I had dashboards and visualizations that I wanted to carry over to the new version of ELK. When I exported my old dashboards into a json file and attempted to import it to the new Kibana instance it gave me an error on all of the visualizations except the timelions. It stated that the indice that was being called out in the json file was not created. All of the visualizations that were an issue were calling the index "_all". I have created the indice "_all" and it is populated with data.
This is an example of what the "searchSourceJSON" is:
Now in previous versions when I have upgraded the ELK stack I have not had an issue with importing the dashboards this way. The error I got stated:
failed: Could not locate that index-pattern (id: _all), [click here to re-create it]
Since I had the _all index created and data was present I made a test visualization calling the index _all and exported it to a JSON file and found this:
In previous versions when I had the visualization use the _all index it exported to the JSON file as in the first "searchSourceJSON" block above, the index was called _all. In this version it seems that the index is based off of its ID.
In my dashboard export I replaced all the _all instances with AV6p1s8QXgAtWV364jlS, the ID for the _all index on my new ELK instance. When I imported the JSON file it now worked and no errors were present.
I think this may be an issue, but maybe someone can tell me if I did something wrong?
My question is, if I want to share my dashboards with someone else who is running their own instance of ELK, will the _all index be "AV6p1s8QXgAtWV364jlS" as well? This seems unlikely. If I am correct and the _all index ID will be different than AV6p1s8QXgAtWV364jlS for other instances of ELK, how can I share my premade dashboards and visualizations without having to go through this workaround?