I am attempting to reload sample dashboards (in this case for Winlogbeat) associated with our custom index patterns - as opposed to the default winlogbeat-*. Here are the steps I followed:
- Exported the target index pattern to ndjson file and verified the index ID.
- Imported the sample dashboards as-is using the winlogbeat.exe setup command (no problem here - the dashboards and visualizations show up in Kibana just fine).
- Exported the new visualizations to ndjson file, then replaced the "id" field with the id in step #1.
- Imported the edited visualizations using "Automatically overwrite all saved objects" setting
- Re-exported the visualization to verify that the overwrite actually happened
- Refreshed fields in the target index pattern
I also tried re-creating the index pattern with "Show advanced options" > and creating a Custom index pattern ID, then using that in the visualization file instead of the long, auto-generated ID. However, when I attempt to open the edited visualization in Kibana, it fails with the following warning:
Saved "field" parameter is now invalid. Please select a new field
I have my Kibana logs set to "verbose" but do not see this error in the logs - only in the Kibana UI. So part of my question is where to find more log info on this warning.