Post URL does not appear to be portable across environments

[eeijlar]

I am using the following snippet to download CSV reports in Kibana:

                    for filename in ${KIBANA_QUERIES}/*.rison; do
                       echo "Processing query file: $filename"
                       CSV_REPORT=$(basename $filename.csv)
                       REPORT_READY=400 
                       REPORT_PATH=$(curl -s --insecure -u "elastic:${ELASTIC_SECRET_UMS}" -H "kbn-version: ${ELK_VERSION}" -XPOST $(cat $filename) | jq -r '.path')
                       echo "Report path: $REPORT_PATH"

                       if  [ -z $REPORT_PATH ]; then
                       while [ "${REPORT_READY}" != "200" ]
                       do
                         REPORT_READY=$(curl -I -s --insecure -u "elastic:${ELASTIC_SECRET_UMS}" -H "kbn-xsrf: true" https://${K8S_NODE_IP}:${KIBANA_NODE_PORT}${REPORT_PATH} | grep HTTP | awk '{print $2}')
                         if [ "$REPORT_READY" == "404" ]; then
                             echo "Exiting on 404"
                             break;
                         fi
                         sleep 1
                         echo "Waiting for report to be ready, status $REPORT_READY"
                       done

                       if [ "$REPORT_READY" == 200 ]; then
                          echo "Report path: $REPORT_PATH"
                          echo "Downloading report to: $CSV_REPORT"
                          curl -s --insecure -u "elastic:${ELASTIC_SECRET_UMS}" -H "kbn-xsrf: true" https://${K8S_NODE_IP}:${KIBANA_NODE_PORT}${REPORT_PATH} --output $HOME/Downloads/$CSV_REPORT
                       fi
                       fi
                    done

The 'rison' files (collected Post URLs from Kibana) were collected about a week ago, and there have been multiple re-installs of Kibana into a kubernetes cluster with new underlying data each time. Downloading CSV files with the rison files, results in empty CSV files, they just contain headers. I am wondering if the Post URL contains a timestamp for a data set that no longer exists in the cluster? Can this be changed if it does?

Thanks
John

[flash1293 (Joe Reuter)]

The post URL includes a saved object id pointing to the saved search. If your Kibana re-install included clearing the kibana index and re-creating saved objects, then that would be a problem. If this is the case, you can export the searches via the saved object API and re-import them.

The post URLs might contain fixed dates, it depends on what you configured in Discover when pulling the post URL - to make them "portable" make sure to keep them relative to the current date, like in this example: