Kibana 5 Visualisations broken after Upgrade to 6

[af_andi]

Hi Guys,

i upgraded last week from 5.6 to 6.2 but now almost all of my old visualisations are broken. If i'll click on a individual vis, i'll be redirected to Management->Saved Object. There i get the error:

There is a problem with this saved object
The index pattern associated with this object no longer exists.
If you know what this error means, go ahead and fix it — otherwise click the delete button above.

I think it has something to do with the kibana(6)-Index?! The Index of the visualisation exists. In the following the MetaData of an example visualisation which is broken:

{
  "index": "auth-*",
  "query": {
    "query_string": {
      "query": "*",
      "analyze_wildcard": true
    }
  },
  "filter": [
    {
      "meta": {
        "index": "auth-*",
        "type": "phrases",
        "key": "tags",
        "value": "ssh_brute_force_attack",
        "params": [
          "ssh_brute_force_attack"
        ],
        "negate": false,
        "disabled": false,
        "alias": null
      },
      "query": {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "tags": "ssh_brute_force_attack"
              }
            }
          ],
          "minimum_should_match": 1
        }
      },
      "$state": {
        "store": "appState"
      }
    }
  ]
}

Do i have to create them again or is there a possibility to bring them back to life?

[tsullivan (Tim Sullivan)]

Unfortunately, when you export saved objects in Kibana, the index patterns are not exported along with them. This is a known issue : Ability to export the index pattern along with saved objects · Issue #4288 · elastic/kibana · GitHub

Until the issue is resolved, which hopefully will be soon, there is a workaround provided by ppf2 on that issue:

With the export's visualization including the index pattern reference, but no actual index settings for the pattern, the user will have to first create dummy index patterns in the target environment just to be able to even import these objects into the target cluster. Obviously these dummy index patterns are of no actual use for querying in the target cluster, so the user will also have to go through a process to update each visualization from the advanced editing screen to change the visualization reference - also tedious because you can't batch change these today (#3668) with each visualization tied to an actual index pattern.

Alternatively, the user will have to hack the exported .json to make changes to all the index references to map to existing indices in the target cluster - easier way, but more risky with the potential to corrupt the export while performing direct modification of the export file.

I would suggest making the new index patterns in the 6.2 version of kibana, and after importing the saved objects, export from the 6.2 version of kibana. Then, go through the new export.json to update the index pattern ID references to the new indices.

For example, I made an export.json from Kibana 6.2.2. I would have to look for lines in the JSON file that look like:

"searchSourceJSON": "{\"index\":\"075f6d00-1735-11e8-82f6-017e545b3fcb\",\"highlightAll\":true,\"version\":true,\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"

The index property references an index pattern in the "old" cluster. After creating a new index pattern, I want to get its ID and replace that in here.

Sorry, I realize this is a pain, and also means that field formatters and scripted fields will have to be created over again

[af_andi]

Thank you. What a mess...a known issue since 2,5 years.

So i exported my Objects, cleared the export file until only my broken visualisations remained and imported the file. After that my visualisations were back again

[tsullivan (Tim Sullivan)]

Sorry again for the pain, but I'm glad you got it working.

New features will depend more on a working cross-integration between saved objects and index patterns, so we hope to see that bug fixed very soon.