Kibana search malfunctions when index patterns configured through API

There is data in ES and when the index pattern is created manually through the GUI search and saved searches function normally. Search and saved searched begin to malfunction when the index patterns are created with the below API calls. Visualizations function normally.

# Create index for palo3 with same ID present in dashboard exports
curl -X POST -d '{ "attributes": { "title": "palo3","timeFieldName": "Generated Time" } }' http://localhost:5601/api/saved_objects/index-pattern/5ff56d90-28bd-11e8-b302-ad792c0fad84 -H "Content-Type: application/json" -H "kbn-xsrf: true"
# Make index default index
curl -X POST -d '{ "value": "5ff56d90-28bd-11e8-b302-ad792c0fad84"}' "localhost:5601/api/kibana/settings/defaultIndex" -H "Content-Type: application/json" -H "kbn-xsrf: anything"

What's the response you get when you do the first curl command?

In the meantime, you can try this. When you create index patterns in the UI, open up your browser's network tab and take a look at the request. Compare it to the one you're sending via curl. That should give you some idea if there's a discrepancy.

The response I get from the first CURL to add the index is below
{"id":"5ff56d90-28bd-11e8-b302-ad792c0fad84","type":"index-pattern","updated_at":"2018-03-18T23:26:09.332Z","version":4,"attributes":{"title":"palo3","timeFieldName":"Generate Time"}}

The response I get from the second CURL to configure the default index is below
{"settings":{"buildNum":{"userValue":16588},"defaultIndex":{"userValue":"5ff56d90-28bd-11e8-b302-ad792c0fad84"}}}

These are both identical to the responses I see in the network tab and the POST requests are also identical to those observed in the network tab. So no discrepancy.

It does seem to have resolved itself now though, perhaps there was some other change that was made during development of the docker image that was causing an issue, a new process that I ran up this morning doesn't see this problem.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.