Importing visualizations from different machine

[yishain11]

Hi, I use kibana and elastic (6) like so:
I have remote centos 7 machine that hosts kibana and elastic, and I access kibana via my broser on another machine.
The thing is I Imported some searches, visualizations and a dashborad I created in a seperate instance of elk, and I saved the json files in the centos machine, and I can't access them because "impot" in kibana only searches for files on the machine that the browser is running on.
How can I import the files that are on the same machine as elastic/kibana?
Is there a simple way to just take the json files and send them to kibana index in elastic via curl?
This is how a imported search looks like in the json file:

[
  {
    "_id": "SOME_ID",
    "_type": "search",
    "_source": {
      "title": "Full Results Search",
      "description": "",
      "hits": 0,
      "columns": [
        "_source"
      ],
      "sort": [
        "_score",
        "desc"
      ],
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"SOME_INDEX\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"
      }
    }
  }
]

and a visualization:

[
  {
    "_id": "SOME_ID",
    "_type": "visualization",
    "_source": {
      "title": "Results Table",
      "visState": "{\"title\":\"Results Table\",\"type\":\"table\",\"params\":{\"perPage\":100,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"asc\"},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"STATUS_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Current Status\"}},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"DESCRIPTION_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Description\"}},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"ENDDATE_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"End Date\"}}]}",
      "uiStateJSON": "{\"spy\":null,\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"asc\"}}}}",
      "description": "",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"SOME_INDEX\",\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}"
      }
    }
  }
]

If there is a way to import those to kibana via curl, is everything in the imported json relevent?

Thanks!

[timroes]

Hey,

please look at the following question for details on the saved object import API: How to import index-pattern in kibana 6 using API?

Cheers,
Tim

[yishain11]

Hi, thanks for the answer.
I tried:
curl -XPOST localhost:5601/api/kibana/dashboards/import -H 'kbn-xsrf:true' -H 'Content-type:application/json' -d @./try_dash.json

First, I changed the fact that by defualt dashboards are exported in an array, and the api recieves only json.
Second, If I keep the _id, _type and _source fields (that are also generated when one export his dashboard/visualizaition) in the file I get "id"/"type"/"source" is not allowed, and that I need to change the version to a string.
Third, Even if I remove the aforementioned fields and change the version, I still get:

{"statusCode":400,"error":"Bad Request","message":"\"title\" is not allowed. \"hits\" is not allowed. \"description\" is not allowed. \"panelsJSON\" is not allowed. \"optionsJSON\" is not allowed. \"timeRestore\" is not allowed. \"kibanaSavedObjectMeta\" is not allowed","validation":{"source":"payload","keys":["title","hits","description","panelsJSON","optionsJSON","timeRestore","kibanaSavedObjectMeta"]}}

What am I doing wrong?
Plus, I saw only api to kibana dashboards. Is there an address for api to kibana that will import searches and visualizations?

ADD:
I tried using the saved_object api like so:
curl -XPOST localhost:5601/api/saved_objects/dashboards -H 'kbn-xsrf:true' -H 'Content-type:application/json' -d @./try_dash.json
and I get this error:
{"message":"mapping set to strict, dynamic introduction of [dashboards] within [doc] is not allowed: [strict_dynamic_mapping_exception] mapping set to strict, dynamic introduction of [dashboards] within [doc] is not allowed","statusCode":400,"error":"Bad Request"}

I don't understand: what dynamic mapping? I'm just trying to put my dashboard/saved search/visualization into exsiting kibana index, what mapping has to do with anything?

[yishain11]

OK, I'm half way there.
First I was able to change the exported objects so they could be imported via cli on there machines, and I will detail how, for anyone else how encounter the same issue:

Kibana 6 objects are exported like so (visualization,searchs and dashboards have there differences, but for the changes that need to be made they are the same):

[
  {
    "_id": "SOME_ID",
    "_type": "visualization",
    "_source": {
      "title": "Results Table",
      "visState": "{\"title\":\"Results Table\",\"type\":\"table\",\"params\":{\"perPage\":100,\"showMeticsAtAllLevels\":false,\"showPartialRows\":false,\"showTotal\":false,\"sort\":{\"columnIndex\":2,\"direction\":\"asc\"},\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"6\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"STATUS_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Current Status\"}},{\"id\":\"7\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"DESCRIPTION_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Description\"}},{\"id\":\"8\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"ENDDATE_newValue.raw\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"End Date\"}}]}",
      "uiStateJSON": "{\"spy\":null,\"vis\":{\"params\":{\"sort\":{\"columnIndex\":2,\"direction\":\"asc\"}}}}",
      "description": "",
      "version": 1,
      "kibanaSavedObjectMeta": {
        "searchSourceJSON": "{\"index\":\"SOME_ID\",\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}"
      }
    }
  }
]

The things to change:

1. Erase the array that stores the object. The saved_object revieces only json objects.
2. searchSourceJSON field has a string value: "{...}" .In order for the api to understand that this is a string and not malformed object you need to do something simple - add space between the first and last double quotes in the value. so: searchSourceJSON: " { .... } " and not searchSourceJSON: "{...}".

That way there will be no errors when you send the objects with this curl:

curl -XPOST localhost:5601/api/saved_objects/search -H 'kbn-xsrf:true' -H 'Content-type:application/json' -d @./full_results_search.json

Hope this helps to anyone.

What I still need help with?
When I import the objects, they don't have the host index id that they need to work.
When I import in kibana, there is a prompt that asks me if I want to change the ID to one on the kibana indexs like this:

What is the cli equivalent for this process?
Currently What I can think of is the annoying way of getting the index id from the command:
GET /.kibana/_search?q=type:index-pattern
seraching for the right index, extracting the id, and replacing the id in the objects, and then sending them via the cli.
Is there a more elegant way to do this?