Saved object is missing Could not locate that search (id: WallDetail.uat1)

Elastic Stack Kibana
1

Hi there,
We are using Elasticsearch and Kibana 7.0.1.
We have a saved search Object called WallDetail.uat1.
Here is how we set it up:

columns  
[
  "_source"
]

kibanaSavedObjectMeta.searchSourceJSON
 {
  "highlightAll": true,
  "version": true,
  "query": {
    "query": "_exists_: \"frame.msg.hostname\" AND frame.dest: bluescape_* AND NOT  frame.dest: \"bluescape_metric\"",
    "language": "lucene"
  },
  "filter": [],
  "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index"
}

references
[
  {
    "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
    "type": "index-pattern",
    "id": "8440bbf0-f1cf-11e9-80ba-2951b30c3b70"
  }
]

If I open this search from the Kibana Discover UI, it loads perfectly fine.

But when we put this search in another link, it reports:
Saved object is missing Could not locate that search (id: WallDetail.uat1)
(We have a similar format link works for kibana 5.2.2. Is this a version related query change?)
And here is my link:

https://kibana7-dev.common.XXXX.com/app/kibana#/discover/WallDetail.uat1?_a=(filters:!((meta:(disabled:!f,index:'openshift.uat1.*',key:frame.msg.hostname,negate:!f,value:'asset1238'),query:(match:(frame.msg.hostname:(query:'asset1238',type:phrase))))))

image
image1213×823 27.1 KB

Thank you.

2

Hi @meiyuan,

If you create an URL like this, discover will automatically add a search: prefix to the id before looking up the document in the .kibana index. Could you put your saved search in a document with the id search:WallDetaul.uat1 and try the same link?

That being said, when using the saved objects api these things should be abstracted away from you (together with a few other convenience things).

3

Hi Joe,

Thank you for the quick reply, but I'm a little lost here.

Do you mean I save the search as the name: search:WallDetail.uat1 ?
Something like this?

image
image1141×49 2.17 KB

image

I tried both
https://kibana7-dev.common.xxxx.com/app/kibana#/discover/WallDetail.uat1?_a=(filters:!((meta:(disabled:!f,index:'openshift.uat1.*',key:frame.msg.hostname,negate:!f,value:'asset1238'),query:(match:(frame.msg.hostname:(query:'asset1238',type:phrase))))))

and

https://kibana7-dev.common.xxxx.com/app/kibana#/discover/search:WallDetail.uat1?_a=(filters:!((meta:(disabled:!f,index:'openshift.uat1.*',key:frame.msg.hostname,negate:!f,value:'asset1238'),query:(match:(frame.msg.hostname:(query:'asset1238',type:phrase))))))

Both are reporting the same error.

Then I did a

GET /.kibana_1/_search
{
    "query": {
        "match_all": {}
    }
}

and it gave out 177 hits.
However, the search I saved search:WallDetail.uat1 is not there.
I could only find 1 "_type" : "search"

image
image1802×743 101 KB

But on the kibana page, it shows that I have 19 saved searches.

image
image1178×782 85.7 KB

Is this normal?

So, could you be more specific about how do I do what you have suggested?
Thank you so much.

The use case for us is that we just want users to click on this link and then Kibana display the discover page.
Maybe I didn't get what you are saying here, what things should be abstracted away and what convenience do users get?

Thank you for your help!

4

I think I misunderstood your use case. I thought you were talking about programmatically creating saved searches via api calls.

But based on your second post your use case is using Kibana via browser, right?

By “called WallDetail.uat1” do you mean the name of the saved search? In older versions of Kibana the Id and the name of a saved search were identical, but that changed. Now the id is a randomly generated string and distinct from the name. In a link like https://kibana7-dev.common.xxxx.com/app/kibana#/discover/abcd the abcd always has to be the id, not the name of the saved object. To get a shareable link, simply open the saved search in discover (by going to discover, clicking the Open button in the menu and selecting the saved search) and copy the url in the address bar.

5

Hi Joe,

It worked! Simple like that, thanks!

Can I ask a related follow up question?

We also have a similar use case with the Dashboard object.

We have this dashboard that includes 10 visualizations.
When I create these visualizations, Kibana asked me to pick an index pattern.
So I created all of them on the index pattern uat1.*.

My question is if I need these dashboard in uat2.*, uat3.*, etc.
Do I need to create the same set of visualizations and a new Dashboard for every index pattern?
If so, what's the easiest way to re-product these vis on a new index pattern?

The reason I ask is because we want user to click on this link based on the index pattern:
If vis and dashboars are based on index pattern, that means the highlighted id will be different per index pattern?

https://kibana7-dev.common.xxx.com/app/kibana#/dashboard/3a541cd0-4d1e-11ea-8d0f-7f1ad495eae8?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-15m,interval:'1m',mode:quick,timezone:America%2FLos_Angeles,to:now))&_a=(filters:!(),options:(darkTheme:!f),panels:!((col:7,id:d60a0c90-b5cf-11e7-8ce6-b1c9f651b1f6,panelIndex:1,row:6,size_x:6,size_y:4,type:visualization),(col:1,id:'3c883370-b5d5-11e7-bbfd-035ce10a7f46',panelIndex:2,row:1,size_x:12,size_y:1,type:visualization),(col:1,id:'4bd2e6a0-b5cf-11e7-a33b-0f05266f5318',panelIndex:3,row:8,size_x:6,size_y:6,type:visualization),(col:1,id:'2786a740-b5df-11e7-a89a-9da1d5fab893',panelIndex:6,row:6,size_x:3,size_y:2,type:visualization),(col:1,id:'6529b270-b5e1-11e7-a89a-9da1d5fab893',panelIndex:7,row:2,size_x:4,size_y:4,type:visualization),(col:4,id:b89ad280-b5e2-11e7-8fc6-45dea0a3ed52,panelIndex:8,row:6,size_x:3,size_y:2,type:visualization),(col:10,id:c01d58a0-b67f-11e7-bec4-7370b473aede,panelIndex:10,row:2,size_x:3,size_y:2,type:visualization),(col:5,id:'920faf20-b680-11e7-80ce-a5b597f08adf',panelIndex:11,row:2,size_x:5,size_y:4,type:visualization),(col:10,id:'2f9cefa0-b681-11e7-bec4-7370b473aede',panelIndex:12,row:4,size_x:3,size_y:2,type:visualization),(col:1,columns:!(frame.dest,frame.msg.severity-text,frame.msg.app,frame.msg.message),id:'0b0d3c70-b682-11e7-b24f-83480f1f9730',panelIndex:13,row:14,size_x:12,size_y:6,sort:!('@timestamp',desc),type:search),(col:7,id:ff1a8470-beb7-11e7-925c-e14ceb573992,panelIndex:14,row:10,size_x:6,size_y:4,type:visualization)),query:(query_string:(analyze_wildcard:!t,query:'frame.msg.hostname.keyword:Yuliya-QA-tiki-asset1006')),title:Bluescape_Controller_Dashboard,uiState:(P-14:(vis:(legendOpen:!f)),P-2:(spy:(mode:(fill:!f,name:!n)),vis:(params:(sort:(columnIndex:!n,direction:!n))))))

Thank you so much for you help!
Meiyuan

6

Unfortunately there is no way to automate this at the moment. This is the relevant feature request: https://github.com/elastic/kibana/issues/16917

You either have to create the dashboards and visualizations manually or write a script to automate it via the saved objects api (e.g. in python).

A workaround not applicable in all situations is to create one index pattern covering all of the data in your various similar looking index patterns, putting a field in your data containing a differentiation between the various environments and create a single dashboard with an input control visualization on top to switch the filter between the documents of each index .

7

Thank you, understood!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.