Saved object export format for Searches

[mikebd (Michael Ben-David)]

For Kibana 6.6, I have exported saved objects from Kibana for offline analysis of broken dependencies.

I'm trying to understand the relevancy of index pattern ids per filter and how it is that they can be different from the index pattern id for the overall saved search.

Are the per filter index pattern ids relevant in terms of breaking execution if the dependency is unresolvable? Can anyone please clarify this export format?

_source.kibanaSavedObjectMeta.searchSourceJSON:

{
    "index": "index-pattern-id-1",
    ...
    "filter": [{
        "meta": {
            "index": "index-pattern-id-2"
...

[markov00 (Marco Vettorello)]

Hi @mikebd,
I think that happens with the following steps:

• open discover
• select one index and add a filter
• then change the index and save the search

If you now open the saved search object you will see that the saved search index is the last one selected and the filter index is the one used when adding the filter.

I will ask to the team what was the rationale behind this behaviour

[mikebd (Michael Ben-David)]

Hi @markov00, thanks for following up.