Rename the index-pattern for sample visualizations

Short version: In the new Kibana Lens app, how do you open existing visualizations to edit?

Long version:
I want to use the sample visualizations/dashboards provided by Filebeat in indices named other than filebeat-*. My ES stack is version 7.11. I've already imported the dashboards using a command filebeat setup --dashboards and confirmed that the dashboards display data when I use the default index name filebeat-*. I have since deleted the default filebeat index and created my own. When I try to edit any of the sample visualizations, the "Edit visualization page shows a warning A field associated with this object no longer exists in the index pattern.

I have found various suggestions in this closed issue, but so far none of them have worked for me:

On 11/26/2020 a user suggests using the new Lens feature to change the index-pattern. When I open the Lens app, I don't see a way to load existing visualizations to edit.

On 8/25/2020 a user suggests exporting a dashboard to re-import it because Kibana will prompt you for a new index pattern. When I do this, the only prompt I get is "Overwrite or Skip"

I've also tried following the advice to update the saved object references to include the dashboard's generated ID. Of the half-dozen objects I attempted to fix, none of them worked, most of them reported the same error or a new one. I need to put more time into figuring out what's wrong here, but my hunch is that Lens should be able to solve this for me. I've reverted this question to a shorter version and left the long version in, in case editing with Lens is broken for some reason.

It's expected you are not able to open existing visualizations in Lens - the saved objects are not compatible and you would have to recreate them from scratch if you want to use Lens.

"Transfering" non-Lens visualizations to a new index pattern is not supported directly, but it is possible to do. I'll try to put together a little tutorial here.

Check first: First, make sure the new index pattern you want to transfer a visualization to has compatible mappings (same fields and same field types) - not all aggregations used by visualizations work for all types of fields, so it's important those match. Otherwise it's just not possible to use the visualization with the different index (e.g. if there's a number field "bytes" in the original index, but in your new index it's a keyword field, then a visualization calculating the sum of "bytes" won't be able to display anything). The error in your screenshot hints at that problem.

Check first: This does not work for TSVB and Timelion visualizations - those are not tied to an index pattern saved object anyway, you can just edit them and change it in the regular editor UI, then save.

Approach 1 - transfer all visualizations from index pattern 1 to index pattern 2

This makes sense if you want to transfer all visualizations currently using an index pattern to a new index pattern (not just some of them).

  • Step 1: Find out the id of the current index pattern.
    • Go to Stack management > index patterns > index pattern 1
    • Look at the URL. It should contain a part like this: /app/management/kibana/indexPatterns/patterns/ff959d40-b880-11e8-a6d9-e546fe2bba5f#
    • The part after patterns/ and before # is the id (in this case ff959d40-b880-11e8-a6d9-e546fe2bba5f). Note it down somewhere
  • Step 2: Delete the old index pattern. Click the trash icon in the top right to delete the index pattern
  • Step 3: Create index pattern 2
    • Go to Stack Management > Index patterns and press "Create index pattern"
    • Enter the name of the pattern and press next
    • Select a time field
    • Click on the "Show advanced settings" button
    • Enter the id you noted down in step 1 in "Custom index pattern ID"
    • Create the index pattern

All visualizations previously associated with index pattern 1 are now associated with index pattern 2

Approach 2 - transfer one visualization at a time from index pattern 1 to index pattern 2

This makes sense if you want to keep most of the visualizations on the old index pattern, but move one of them to another index pattern.

  • Step 1: Create index pattern 2
    • Go to Stack management > index patterns
    • Enter the name of the pattern and press next
    • Select a time field
    • Create the index pattern
    • Look at the URL. It should contain a part like this: /app/management/kibana/indexPatterns/patterns/ff959d40-b880-11e8-a6d9-e546fe2bba5f#
    • The part after patterns/ and before # is the id (in this case ff959d40-b880-11e8-a6d9-e546fe2bba5f). Note it down somewhere
  • Step 2: Switch the visualization over
    • Go to Stack management > saved objects
    • Search for the visualization you want to transfer
    • Click the three dots, then select "Inspect"
    • Scroll down to the "references" section. It will look like this:
[
  {
    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
    "type": "index-pattern",
    "id": "90943e30-9a47-11e8-b64d-95841ca0b247"
  }
]
    • Change the "id" to the id you noted down in step 1
    • Save the visualization

This single visualization is now tied to index pattern 2 instead of index pattern 1 (all other visulizations are still tied to index pattern 1)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.