Kibana 5.0.2 reset defaultIndex manually

[kaem2111 (Martin Kaemmerling)]

Hello,
I am using kibana 5.0.2. I have accidentially removed default index pattern for logstash-* and now I am not able to set it again using Management=>Advanced settings, because Management unfortunaly requires valid defaultIndex before starting as shown here

Kibana reinstall did not work.
Is there an alternate way to setup defaultIndex field manually?

[spalger (Spencer Alger)]

Yeah, that's a known bug (https://github.com/elastic/kibana/issues/9028).

edit: you should be able to send a post request to the kibana server like this:

#change for your needs
KIBANA_URL="http://localhost:5601"
NEW_INDEX="logstash-*"

curl -XPOST "$KIBANA_URL/api/kibana/settings/defaultIndex" -d "{
  \"value\": \"$NEW_INDEX\"
}"

[kaem2111 (Martin Kaemmerling)]

I already tried that before, but always got a

{"statusCode":400,"error":"Bad Request","message":"Request must contain an kbn-xsrf header"}

and assumed that this was implemented to protect the api.

I solved this issue now by doing a:

curl -u imyii:$px -XGET "http://by0kmi:5601/api/kibana/settings"

{"settings":{"buildNum":{"userValue":14476},"timelion:showTutorial":{"userValue":false},"dashboard:defaultDarkTheme":{"userValue":true},"timepicker:timeDefaults":{"userValue":"{\n "from": "now-1h",\n "to": "now",\n "mode": "quick"\n}"},"defaultIndex":{"userValue":"[.marvel-es-]YYYY.MM.DD"},"discover:aggs:terms:size":{"userValue":20}}}

and create a new index using console

PUT /.marvel-es-2016.11.11
{
}

This make the tools available again
Thank you for the hints!