I have a use-case that demands reading out the API for saved searches in Kibana and retrieving the results.
There seems to be no API for Kibana to do this.
A defined saved search can be retrieved and in it's json response you can find the field 'kibanaSavedObjectMeta.searchSourceJSON' which has the following structure:
{
"index": "a40f4f20-972d-11e9-a4aa-9b663566a96d",
"highlightAll": true,
"version": true,
"query": {
"language": "kuery",
"query": ""
},
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": null,
"disabled": false,
"index": "a40f4f20-972d-11e9-a4aa-9b663566a96d",
"key": "_type",
"negate": false,
"params": {
"query": "datacenter-patching",
"type": "phrase"
},
"type": "phrase",
"value": "datacenter-patching"
},
"query": {
"match": {
"_type": {
"query": "datacenter-patching",
"type": "phrase"
}
}
}
},
{
"meta": {
"negate": false,
"index": "a40f4f20-972d-11e9-a4aa-9b663566a96d",
"type": "phrase",
"key": "doc.Patching Status",
"value": "Non-compliant",
"params": {
"query": "Non-compliant",
"type": "phrase"
},
"disabled": false,
"alias": null
},
"query": {
"match": {
"doc.Patching Status": {
"query": "Non-compliant",
"type": "phrase"
}
}
},
"$state": {
"store": "appState"
}
}
]
}
Now, after a lot of Google searches I can't seem to find a way to transform this in a Elasticsearch query or something useful to retrieve the actual results.
Strange because if you go to the saved search in the UI > Inspect > Request, you can see the actual Elasticsearch query I need.
Anybody any idea?