Restore saved objects from a remote .kibana index


I tried to reindex .kibana_2(latest) of our production elastic to my local elastic. The problem is that Not all the saved objects have been transferred.

What kind of data .kibana_2 includes? Shouldn't all saved objects be included in .kibana_2?

Thank you in advance!


Hi Angelos,

Everything that's visible under "Saved Objects Management" is stored in the index the .kibana alias points to. So if .kibana points to .kibana_3 you should reindex .kibana_3 and after reindexing point your local .kibana to the reindexed index.

For more background see

Note, you can also export all your saved objects from your production cluster as an NDJSON file and import this file locally:

1 Like

Hello Rudolf,
Thank you for you fast response!

I did exactly that, but I don't have all the saved objects locally.

I am aware of that but since we have several spaces in production i have to do it for every space.

I should mention as well that after reindex I had 5 failures regarding canvas-workpad-template:

      "index" : ".kibana_16",
      "type" : "_doc",
      "id" : "canvas-workpad-template:workpad-template-11111111-qqqq-wwww-2222-333333333333",
      "cause" : {
        "type" : "illegal_argument_exception",
        "reason" : "mapper [canvas-workpad-template.template.pages.elements.position.left] cannot be changed from type [float] to [long]"
      "status" : 400

Could that be the problem and if yes how can I fix it?


Yes, I should have mentioned that, but you will need to set the mappings of your local index so that it matches your remote .kibana_N index before you start reindexing.

Kibana's Saved Objects rely on fixed mappings for the .kibana_N index, so if you just create a new index and start reindexing the inferred mappings will be incorrect.

Although a remote reindex should work, restoring from a snapshot will be simpler and less error prone, you'll get all the index settings, mappings and aliases from the snapshot instead of having to do this manually.

Thank you I will try that!

I tried restoring from snapshot but I had problem with the version since the production is 7.9.2 and I have to use 7.9.1 locally.

@rudolf So I should copy the mapping of .kibana_N and put the mapping in which "local index"?
Because before reindex I am deleting .kibana index from local elastic, shouldn't I?

I didn't test these instructions, but hopefully this will help you get it right. The complete steps would be something like:

  1. remote: GET /.kibana/_mappings
  2. local: POST /.kibana_1 {"mappings": <mappings from step 1>, "aliases": {".kibana": {}}
  3. local: reindex remote .kibana into local .kibana (using the aliases instead of concrete index will maybe be a little less error prone so you don't accidentally use the wrong index)
1 Like

@rudolf It worked! Thank you very much!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.