Kibana Visualization Deleted Index

(Adwait Joshi) #1

I had to delete the elasticsearch index on our system and then recreate it, I thought as long as the index was called the same etc, Kibana Visualizations will keep running. I recreated the index in Kibana and the visualizations complain that it doesn't exist, and that I should recreate it. But the index it wants me to recreate is the EXACT same index that already exists. What needs to happen here?

(Nick Peihl) #2

Visualizations are saved with the unique ID associated with an index pattern. You've deleted the index pattern and then re-created it. Even though it has the same name, it was given a new ID. This ID appears in the URL bar when you select the index pattern in "Management - Index Patterns".

You'll need to change the ID in each of your visualizations by finding and editing them in "Management - Saved Objects". See the third bullet in this section.

If you have a lot of visualizations, you might use the "Export <#> objects" link in the "Saved Objects" to download a JSON config file. You can then do a "Find and Replace" in your text editor to change the ID in that file and then import it from the "Management - Saved Objects" page. Be careful and keep a backup of the original JSON file just in case something goes wrong.

(Adwait Joshi) #3

I see the index showing the name and not ID see below

"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":"accounts*","filter":[{"meta":{"index":"accounts*","negate":true,"disabled":false,"alias":null,"type":"phrase","key":"age","value":"-30","params":{"query":-30,"type":"phrase"}},"query":{"match":{"age":{"query":-30,"type":"phrase"}}},"$state":{"store":"appState"}}],"query":{"query":"","language":"lucene"}}"

(Adwait Joshi) #4

I reimported all my dashboards and it asked me to remap

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.