Kibana API to Query Dashboard or Visualisation Metadata

Elastic Observability
1

ELK Stack Version 8.17.2

Problem -
Too many unused dashboards, visualisations - that need to be identified and removed (criteria - 0 views in 90 days, last updated < 1 year)

For a given Kibana API Query -
/api/dashboards/dashboard or /api/dashboards/dashboard/{id}

Question

  • How do I get the same stats , that is shown to me when I click on ? marker against a dashboard name?
    I want specifically - to fetch via API the following -
  • Name,
  • Tags,
  • Description,
  • Created By,
  • Last Updated By,
  • Views ( in last 90 days)

I was able to view this via inspect element , but how do I do this via API?
I cannot see this data, when i used?

Let me know for any endpoints , that might be hidden (or) - relatively unknown.

Appreciate any help I can get.
Thanks!

2

Hello,

The API used is an internal one: kbn:/internal/content_management/insights/dashboard/{id}/viewed/stats

The bad news is that internal APIs will be restricted starting with Elastic 9.0, so this is not the way to go.

Name and description are in the Dashboard API, so they are easy.

To get the tags, you need to read the dashboard and then find the tag references. Those can then be resolved using the saved-object API:

GET kbn:/api/saved_objects/tag/{tag-id}

To get the usage, this may help you:

POST .kibana_usage_counters*/_search?size=1000
{
    "query": {
        "bool": {
            "must": [
              {
                "term": {
                  "usage-counter.counterName": {
                    "value": "{id}"
                  }
                }
              }
            ]
        }
    }
}

Created By, Updated By are an issue again as they require access to the internal API (blocked with 9.0 again). Read the IDs of the Users from the dashboard API and look them up from the user profiles:

POST kbn:/internal/security/user_profile/_bulk_get
{"uids":["u_jWVHFUVDB9fLX46n2HvF1-6BhFs1Wlx1Ew0ZNIARFCM_1"]}

I am sorry to say that I have no idea how to workoaround the issues for created/updated by. Still I hope this helps you to get started.

Best regards
Wolfram

3

Hi @Wolfram_Haussig -

Thanks for the lead! - Yes initially we had a hint that this most likely is an internal API , you confirmed it.

You see what we're trying to achieve is something like this

image
image1995×879 148 KB

but I do not know , what was queried - to arrive at this dashboard, we want to consume the same, but via APIs?

(I understand, the only way to do this right now might be via internal APIs, which is further being restricted from 9.0)

However, we're looking at a 1 time activity - of carrying out the cleanup task, so we will use the /internal/content-management endpoint .

4

Maybe this query helps you:

POST .kibana_usage_counters*/_search?size=1000
{
    "query": {
        "bool": {
            "must": [
              {
                "term": {
                  "usage-counter.counterType": {
                    "value": "viewed"
                  }
                }
              },
              {
                "range": {
                  "updated_at": {
                    "gte": "now-30d"
                  }
                }
              }
            ]
        }
    },
    "aggs": {
      "usage": {
        "terms": {
          "field": "usage-counter.counterName"
        },
        "aggs": {
          "count": {
            "sum": {
              "field": "usage-counter.count"
            }
          }
        }
      }
    }
}

It reads the usage of the objects and aggregates them to show the total view count for the last 30 days.