We'd like to programmatically access saved searches to count the number of log lines they return by using the ES query and get the count from ES directly. These monitoring saved searches will be created by a separate team therefore any queries with a specific key name in the title would automatically be monitored.
The problem we have is that the Kibana API is quite limited at this point in time:
- There is no way to remotely run a query and get results
- The "Request" tab from the "Inspect" link returns a valid ES query/filter BUT it does not seem we get this info from the saved object.
Why do we want that?
We'd like to detect issues in the logs by removing all known logs and if an error or an unexpected log line appears then it will trigger an alarm (via a script or polling).
How far did we get ?
We can find the saved searches with a specific key names BUT the blocker is that kibanaSavedObjectMeta.searchSourceJSON is NOT a valid ES query/filter unlike what we find in Request in the web interface.
What are our options? Is it the right approach?
We are running Kibana 6.5.
curl kibana.domain.tld/api/saved_objects/_find?type=search&per_page=100&search=MONITORING' | jq '.saved_objects.attributes | [ .title, [ .kibanaSavedObjectMeta.searchSourceJSON | fromjson ] ] '