Save & Re-use searches/visualizations/dashboards


(KIbana 4)

I'm running the ELK stack locally on Ubuntu by simply unpacking into the user's ~/opt folder and then e.g. bin/kibana, per the basic instructions in the various guides.

My use case is analysis of datasets consisting of pre-captured logs, and I'm running a fresh VM/container for each dataset.

I want to set up a load of searches/visualizations/dashboards that I can re-use in each VM/container. The idea is to spin up a fresh VM/container with the ELK stack, drop in the data, drop in the saved searches/visualizations/dashboards, run the ELK tools and have all the searches/visualizations/dashboards results magically appear.

However, I can't see where the various items are saved. Are they only the URLs, or are they stored to disk anywhere?


They are stored in the .kibana index in ES.

KB4.1 will allow you to export and import a JSON file as an option, it'll be out really soon.

Thanks Mark for the quick reply.

Can you confirm that all three - searches, visualization, and dashboards - are all stored in this way, and that all will be accessible via the up-coming import/export option?

Is there a date for 4.1 yet?


It came out hours ago :slight_smile:

Yes.. KB 4.1 supports EXPORT/IMPORT json.


Awesome! This stuff is brilliant.