JSON definition for a index, Visualization and Dashboard in 7.1

pgervais · June 14, 2019, 2:07am

Where can I find in the kibana source code on GitHub, the JSON definition for a visualization and dashboard?
I'm feeding data into ELK via logstash. Once the data has been included, I want to use the REST API Object interface to create index, visualization and dashboards. What's missing from the documentation is the JSON definition of these types?
For example: If I can update the attribute field via Update Object, what is the definition of the attribute field?

Where are these defined in the source code or anywhere else?

christophilus · July 2, 2019, 7:14pm

You can check out the mapping here:

github.com

elastic/kibana/blob/master/src/legacy/core_plugins/kibana/mappings.json

{
  "index-pattern": {
    "properties": {
      "fieldFormatMap": {
        "type": "text"
      },
      "fields": {
        "type": "text"
      },
      "intervalName": {
        "type": "keyword"
      },
      "notExpandable": {
        "type": "boolean"
      },
      "sourceFilters": {
        "type": "text"
      },
      "timeFieldName": {
        "type": "keyword"

This file has been truncated. show original

Those describe the shape of the data in the Kibana index, including dashboards and visualizations. It's only partially useful, though, because some of the fields are just JSON blobs, and the mappings won't help you there. Each visualization can potentially have its own JSON blob.

I'm not sure what the best way forward is. One way is to dig into the code for whatever visualization(s) you want to generate. Another is to reverse engineer it by manually creating some visualizations and dashboards, and then looking at the raw docs in Elasticsearch.

However, I should note that the format of this data can change from release to release, since it's not part of our publicly supported API... so, whatever solution you come up with may not be forward compatible for very long.

system · July 30, 2019, 7:14pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.