Saved Objects imported via Kibana API do not display

[pheathers]

I have been working to script the import of an index pattern with a fields. The import appears to run successfully, but when I try to display the imported index pattern under Kibana | Index Patterns, it fails to load. All I see is a blank screen.

I'm using the following PowerShell script to create the index pattern

$url = "http://localhost:5601/api/saved_objects/index-pattern/my-pattern";

$body = @"
{
    "attributes": {
        "title": "my-pattern-*",
        "timeFieldName": "@timestamp",
        "fields": [
            {
		        "name": "field1",
		        "type": "string",
		        "count": 0,
		        "scripted": false,
		        "searchable": true,
		        "aggregatable": false,
		        "readFromDocValues": false
	        }
        ]
    }
}
"@;

$params = @{
    Uri         = $url;
    Method      = 'POST';
    Headers     = @{ 'kbn-xsrf' = "true" }
    ContentType = 'application/json';
};

$Result = Invoke-WebRequest @params -Body $body;
Write-Host $Result.StatusCode;
Write-Host $Result;

I receive an HTTP 200 response with the following JSON

{
	"type": "index-pattern",
	"id": "my-pattern",
	"attributes": {
		"title": "my-pattern-*",
		"timeFieldName": "@timestamp",
		"fields": [
			{
				"name": "field1",
				"type": "string",
				"count": 0,
				"scripted": false,
				"searchable": true,
				"aggregatable": false,
				"readFromDocValues": false
			}
		]
	},
	"references": [],
	"migrationVersion": {
		"index-pattern": "7.11.0"
	},
	"coreMigrationVersion": "7.12.0",
	"updated_at": "2021-09-10T13:31:54.118Z",
	"version": "WzE4NDcsMTFd",
	"namespaces": [
		"default"
	]
}

I can then see the new index pattern under Kibana | Index Patterns or under Kibana | Saved Objects. However, when I try to view the Index Pattern, it fails to load. The browser Dev Tools | Console shows the following message

Uncaught (in promise) SyntaxError: Unexpected token o in JSON at position 1
    at JSON.parse (<anonymous>)
    at index_patterns_IndexPatternsService.savedObjectToSpec (data.plugin.js:1)
    at index_patterns_IndexPatternsService.getSavedObjectAndInit (data.plugin.js:1)

If I look at the Dev Tools | Network, I can see that Kibana is making a request for the data of the index pattern and it returns JSON in the _bulk_get request. It is immediately after this request that the error displays.

{
	"saved_objects": [
		{
			"id": "my-pattern",
			"type": "index-pattern",
			"namespaces": [
				"default"
			],
			"updated_at": "2021-09-10T13:31:54.118Z",
			"version": "WzE4NDcsMTFd",
			"attributes": {
				"title": "my-pattern-*",
				"timeFieldName": "@timestamp",
				"fields": [
					{
						"name": "field1",
						"type": "string",
						"count": 0,
						"scripted": false,
						"searchable": true,
						"aggregatable": false,
						"readFromDocValues": false
					}
				]
			},
			"references": [],
			"migrationVersion": {
				"index-pattern": "7.11.0"
			},
			"coreMigrationVersion": "7.12.0"
		}
	]
}

If I import the index pattern without the fields attribute, it imports successfully.

Any thoughts on what's wrong?

[pheathers]

My example above created an index pattern (my-pattern), but the index pattern didn't match any indexes. When I created an index pattern which matched existing indexes, I was able to create the index pattern via the Kibana API, however I didn't include any fields (note, dclogstash-troubleshooting is the name of my index)

$url = "http://localhost:5601/api/saved_objects/index-pattern/dclogstash";

$body = @"
{
    "attributes": {
        "title": "dclogstash-*",
        "timeFieldName": "@timestamp"
    }
}
"@;

$params = @{
    Uri         = $url;
    Method      = 'POST';
    Headers     = @{ 'kbn-xsrf' = "true" }
    ContentType = 'application/json';
};

$Result = Invoke-WebRequest @params -Body $body;
Write-Host $Result.StatusCode;
Write-Host $Result;

When I did this all of the fields associated with the index appeared in the index pattern.

[mattkime (Matthew Kime)]

@pheathers What version of the elastic stack are you using? Its possible that there's a better API for your needs - Create index pattern API | Kibana Guide [7.14] | Elastic

Note that you shouldn't need to 'refreshFields' unless you need to see the field list in the response.

[pheathers]

Hi @mattkime . I'm using Kibana 7.12.

What I noticed is that if I don't include the fields and the newly created index pattern has a match for an existing index, all of the fields show in the index pattern.

[mattkime (Matthew Kime)]

@pheathers Yes, that is correct. Are you trying to modify the field list in some manner?

[pheathers]

Yes, and likely incorrectly. I thought that I would be able to create the index pattern and all of the fields manually, but what I learned is that I only have to create the index pattern and associate with existing indexes.

That is all I needed. I appreciate the help.