Kibana Dashboard and default index related question?

Elastic Stack Kibana
1

I have two indices Logstash-1 and Logstash-2. I have set Logstash-1 as default in Kibana.
Created visualizations and added in generic Dashboard. Which will load data of default set index.
Is there any way I can share this generic dashboard for Logstash-2 by keeping default setting i.e. Logstash-1.

I am sharing HTTP request:
http://172.27.56.52:5601/#/dashboard/Master-Dashboard?_a=(filters:!(),panels:!((col:1,id:Select-Project,row:1,size_x:5,size_y:3,type:visualization),(col:6,id:Select-Run,row:1,size_x:4,size_y:3,type:visualization),(col:10,id:Select-Duration,row:1,size_x:3,size_y:3,type:visualization),(col:1,id:Scenario-Summary,row:4,size_x:12,size_y:2,type:visualization),(col:1,id:Transaction-Summary,row:6,size_x:12,size_y:3,type:visualization)),query:(query_string:(analyze_wildcard:!t,query:'*')),title:'Master%20Dashboard')&_g=(refreshInterval:(display:Off,pause:!f,section:0,value:0),time:(from:now-1y,mode:quick,to:now))

Is there any way where i can pass on index Logstash-2 in above request?

2

The index-pattern is set at the visualization level, not the dashboard level, so there isn't a way to simply swap out the index pattern for an entire dashboard. There also isn't an easy way to swap the index pattern backing a visualization. This info is stored in kibana's configuration index in elasticsearch as a part of the saved visualization object. You could theoretically change the index pattern for a visualization in the Settings -> Objects section of Kibana, and you could duplicate them in bulk by using the export/import feature.

But that's probably not something you want to do. Toying with the saved objects is messy and error prone. What exactly are you trying to accomplish? Typically if you have two indices with identically structured data, you'd create an index pattern that includes both of them (e.g. logstash-*). Then if you wanted to create a visualization or dashboard that includes only data from one index, you'd do so by adding filters or date ranges (and these CAN be easily modified across dashboards and visualizations).

3

I am trying to share a common Dashboard to all users.

Mostly I would have single ES index (common for all) which would be filter based on DOC [field==value], this index will be set as default-index in Kibana.

But I have another case too where same Dashboard will be shared with specific user, which should be mapped with specific user's index rather than common index.

I have removed '"index":' from visualization's "kibanaSavedObjectMeta.searchSourceJSON", so these visualizations which are added in Dashboard populates data from index which is set as default.

Therefore I am looking out a way of sharing the common Dashboard with specific user which overwrites the index set as default and should mapped with specific user's index.

4

Unfortunately I don't think there's an easy way to achieve that exact scenario at the moment. If you need the data in the two indices to be totally separate in Kibana, you probably need to manually recreate the visualizations for the second index (or export, batch update, and re-import). I'd warn against removing the index property from the saved visualization object, as I believe the behavior in that scenario is undocumented and could change in future versions of Kibana.