Saved objects api

Elastic Stack Kibana
1

Hi, please help me with my problem:

i am trying to import searches and index-patterns using api from https://github.com/elastic/kibana/pull/11632. I perform:

curl -X POST 'http://localhost:5601/api/saved_objects/search' -H 'Content-Type: application/json' -H "kbn-xsrf: true" -d "@savedObjectsApiSearch.json"

This json is:

{"page":1,"per_page":20,"total":1,"saved_objects":[{"id":"dc9eed20-e3b8-11e7-86b9-0f428dc7955f","type":"search","version":1,"attributes":{"title":"My Search","description":"","hits":0,"columns":["tier","timeDelta","timeDeltaSecondary","priceDeltaSecondary","priceDelta"],"sort":["datetime","desc"],"version":1,"kibanaSavedObjectMeta":{"searchSourceJSON":"{"index":"c640b120-df22-11e7-86b9-0f428dc7955f","highlightAll":true,"version":true,"query":{"language":"lucene","query":""},"filter":}"}}}]}

That was obtained by another request (from the same api):

curl "http://myhost:5601/api/saved_objects/search" > savedObjectsApiSearch.json

But i have an error:

{"statusCode":400,"error":"Bad Request","message":"child "attributes" fails because ["attributes" is required]. "page" is not allowed. "per_page" is not allowed. "total" is not allowed. "saved_objects" is not allowed","validation":{"source":"payload","keys":["attributes","page","per_page","total","saved_objects"]}}

It is worth mentioned that previously (maybe month ago) these requests work properly(

2

did you update kibana version in this time (since it worked till now that it doesnt ?)

it works if you just try to add an object (i am not aware about it ever working with direct output from the GET api):

updated savedObjectApiSearch.json:

{
	"attributes": {
		"title": "My Search",
		"description": "",
		"hits": 0,
		"columns": ["tier", "timeDelta", "timeDeltaSecondary", "priceDeltaSecondary", "priceDelta"],
		"sort": ["datetime", "desc"],
		"version": 1,
		"kibanaSavedObjectMeta": { "searchSourceJSON":"{"index":"c640b120-df22-11e7-86b9-0f428dc7955f","highlightAll":true,"version":true,"query":{"language":"lucene","query":""},"filter":[]}" }
	}
}
1 Like
3

Thanks for the fast answer.
I edit your json a bit:

{
  "attributes": {
    "title": "My Search",
    "description": "",
    "hits": 0,
    "columns": ["tier", "timeDelta", "timeDeltaSecondary", "priceDeltaSecondary", "priceDelta"],
    "sort": ["datetime", "desc"],
    "version": 1,
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": {
        "index": "7bf170f0-f557-11e7-8318-f73036481493",
        "highlightAll": true,
        "version": true,
        "query": {
          "language": "lucene",
          "query": ""
        },
        "filter": []
      }
    }
  }
}

But it stil tells me:

{"message":"failed to parse [search.kibanaSavedObjectMeta.searchSourceJSON]: [mapper_parsing_exception] failed to parse [search.kibanaSavedObjectMeta.searchSourceJSON]","st atusCode":400,"error":"Bad Request"}

What it could be about?

4

Oh, sorry, it seems that i should escape characters in searchSourceJSON.

5

Thanks a lot! This works:

Post Search 
{
	"attributes": {
		"title": "My Search",
		"description": "",
		"hits": 0,
		"columns": ["tier", "timeDelta", "timeDeltaSecondary", "priceDeltaSecondary", "priceDelta"],
		"sort": ["datetime", "desc"],
		"version": 1,
		"kibanaSavedObjectMeta": { "searchSourceJSON":"{"index":"c640b120-df22-11e7-86b9-0f428dc7955f","highlightAll":true,"version":true,"query":{"language":"lucene","query":""},"filter":[]}" }
	}
}

Please, may be you could provide me with index-pattern posting too?
Using these api i get index-pattern:

{
  "attributes": {
    "title": "my-pattern*",
    "timeFieldName": "date",
    "fields": "[A lot of Fields]",
    "fieldFormatMap": "{\"symbol\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/cad21890-f9db-11e7-baf8-9b07099e3d94?_g=(refreshInterval:('$$hashKey':'object:6718',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Asia%2FBaghdad,to:now))&_a=(columns:!(symbolId,symbol,b1,s1,b2,s2,b3,s3),filters:!(),index:'8bfca640-f557-11e7-8318-f73036481493',interval:auto,query:(language:lucene,query:'symbol:%22{{value}}%22'),sort:!(datetime,desc))\",\"labelTemplate\":\"{{**value**}}\"}},\"symbolId\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/cad21890-f9db-11e7-baf8-9b07099e3d94?_g=(refreshInterval:('$$hashKey':'object:6718',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Asia%2FBaghdad,to:now))&_a=(columns:!(symbolId,symbol,b1,s1,b2,s2,b3,s3),filters:!(),index:'8bfca640-f557-11e7-8318-f73036481493',interval:auto,query:(language:lucene,query:'symbolId:%22{{value}}%22'),sort:!(datetime,desc))\",\"labelTemplate\":\"{{**value**}}\"}},\"tier\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/70df35c0-f9db-11e7-baf8-9b07099e3d94?_g=(refreshInterval:('$$hashKey':'object:6718',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Asia%2FBaghdad,to:now))&_a=(columns:!(tierId,tier,priceDelta,timeDelta,priceDeltaSecondary,timeDeltaSecondary,convergenceDelta),filters:!(),index:'7bf170f0-f557-11e7-8318-f73036481493',interval:auto,query:(language:lucene,query:'tier:%22{{value}}%22'),sort:!(datetime,desc))\",\"labelTemplate\":\"{{value}}\"}},\"tierId\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/70df35c0-f9db-11e7-baf8-9b07099e3d94?_g=(refreshInterval:('$$hashKey':'object:6718',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Asia%2FBaghdad,to:now))&_a=(columns:!(tierId,tier,priceDelta,timeDelta,priceDeltaSecondary,timeDeltaSecondary,convergenceDelta),filters:!(),index:'7bf170f0-f557-11e7-8318-f73036481493',interval:auto,query:(language:lucene,query:'tierId:%22{{**value**}}%22'),sort:!(datetime,desc))\",\"labelTemplate\":\"{{value}}\"}}}"
  }
}

When i am trying to post it, there is an error:

{"statusCode":400,"error":"Bad Request","message":""value" mus t be an object","validation":{"source":"payload","keys":["value"]}}

I think this value error is connected to URL Template - Url format values in my patterns. How to escape it?

6

so what i tried:

curl "http://localhost:5601/api/saved_objects/index-pattern/2081fa30-0021-11e8-986a-11b6eea8e9ce" > ip.json

this will export my index pattern to ip.json, which looks like this:

{"id":"2081fa30-0021-11e8-986a-11b6eea8e9ce","type":"index-pattern","updated_at":"2018-01-23T09:38:12.340Z","version":2,"attributes":{"title":"exception_index","fields":"[{\"name\":\"Date&Time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Level\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Message.ExceptionList\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Message.Root\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}]"}}

now i just remove the id, type,updated_at and version (i don't change anything else):

{"attributes":{"title":"exception_index","fields":"[{\"name\":\"Date&Time\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Level\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Message.ExceptionList\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Message.Root\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"Title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false}]"}}

and then import with:

curl -X POST 'http://localhost:5601/hga/api/saved_objects/index-pattern/' -H 'Content-Type: application/json' -H "kbn-xsrf: true" -d "@ip.json"

which works as expected

7

Yes, i have tried smthg like this, but you have not fieldFormatMap in you index-pattern (without it everything works well). I think exactly this field causes problem, because i have URl reference to discovery field in such place as:

"fieldFormatMap": "{\"symbol\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/cad21890-f9db-11e7-baf8-9b07099e3d94?_g=(refreshInterval:('$$hashKey':'object:6718',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Asia%2FBaghdad,to:now))&_a=(columns:!(symbolId,symbol,b1,s1,b2,s2,b3,s3),filters:!(),index:'8bfca640-f557-11e7-8318-f73036481493',interval:auto,query:(language:lucene,query:'symbol:%22\\{\\{value\\}\\}%22'),sort:!(datetime,desc))\", other filds...
There i have got symbol field in my index and it will refere to /app/kibana#/discover/cad21890-f9db-11e7-baf8-9b07099e3d94 with different settings, and there is a value:
query:(language:lucene,query:'symbol:%22{{value}}%22')
that will refer to a link when clicking. I think exactly this value causes my error. I have tried to escape {{value}} using double "\" like:
\{\{value\}\}
but still it doesnt work.

8

It seems i pick it up.
Thanks for your time

9

could you comment on what you changed/ how you made it work, for future reference if someone else hits the same problems ?

thanks.

10

As usual everything worked itself, like magic.
I dont think, that i change smthg. I get a well-worked index-pattern:

{
  "attributes": {
    "title": "my pattern*",
    "timeFieldName": "date",
    "fields": "[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"datetime\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"symbol\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"symbol.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tier\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"tier.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
    "fieldFormatMap": "{\"tier\":{\"id\":\"url\",\"params\":{\"urlTemplate\":\"/app/kibana#/discover/dc9eed20-e3b8-11e7-86b9-0f428dc7955f?_g=(refreshInterval:('$$hashKey':'object:5445',display:Off,pause:!f,section:0,value:0),time:(from:now-6M,interval:'5s',mode:quick,timezone:Europe%2FMinsk,to:now))&_a=(filters:!(),interval:auto,query:(language:lucene,query:'tier:%22{{value}}%22'),sort:!(datetime,desc))\",\"labelTemplate\":\"{{value}}\"}}}"
  }
}

I thought, as i get it from kibana it doesn't need any interventions, so i posted it and there were not any errors:

curl -X POST 'http://localhost:5601/hga/api/saved_objects/index-pattern/' -H 'Content-Type: application/json' -H "kbn-xsrf: true" -d "@ip.json"

I was trying to compare my previous post and current, but dont notice any miscoincedance
Anyway, thanks a lot

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.