I would like to import the pre-made dashboards of filebeat into Kibana, but using another index name. Is there any way to import the JSON files that are distributed with filebeat manually? I can't seem to find any working documentation on how to perform that kind of import. The dataformat in the json files distributed with Filebeat doesn't mach the Saved objects data format, although the saved data format seems to wrap the same data format.
I would expect that there would be some kind of API but everything I find references Saved Objects API. I guess I could try to rewrite the json files to match the format, but I would also expect there to be some way to import these files that I am missing?
Alright, I managed to do what I wanted by downloading the filebeat.tar.gz extracting it and then modified the templates within. When I had made the changes, and removed the templates for dashboards I wouldn't use I followed the "Setup dashboard for Logstash" on this page: https://www.elastic.co/guide/en/beats/filebeat/current/load-kibana-dashboards.html
Now, at first it didn't work, complaining about no indices matching pattern my-index-pattern-*, even if the pattern was correct. To solve this issue I went to the saved objects page, exported all of the recently imported dashboards, visualizations and searches then deleted them. When importing the objects again I was offered to choose which Index to use instead, and after choosing my defined index pattern, it worked!
It does seem like quite a awkward workaround though, and I am sure that I am missing something obvious.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.