Saving a static dahboard in Kibana5

Elastic Stack Kibana
1

Hi,

I have created a dashboard which I would like to save to a file which I can load after next clean installation of my ELK stack by using curl.

Is this possible in Kibana5?

I found some limited documentation for Kibana3 but nothing for Kibana5.
http://10.68.32.192:5601/app/kibana#/dashboard

I can see find my dashboard using a simple query but I do not think the visualizations are stored here.
curl http://elasticsearch:9200/.kibana/dashboard/_search?pretty

My visualizations are stored separately:
curl http://elasticsearch:9200/.kibana/visualization/_search?pretty

If it is possible to save the dashboard to a json file then I also wonder how to load this?
Is it enought to print them with curl and and then load them back using curl XPUT?

curl -XPUT 'http://elasticsearch:9200/.kibana/visualization' -d@/tmp/my_visualization1.json
curl -XPUT 'http://elasticsearch:9200/.kibana/visualization' -d@/tmp/my_visualization2.json
curl -XPUT 'http://elasticsearch:9200/.kibana/visualization' -d@/tmp/my_visualization3.json
curl -XPUT 'http://elasticsearch:9200/.kibana/dashboard/' -d@/tmp/my_dashboard.json

Are there no tools for doing this?

Br Mathias

2

There is a tool built in to Kibana for this. If you go to the Management tab, Saved Objects, you can export and then later import whatever you want (including everything).

If you export a Dashboard, you would also have to export the Visualizations and/or Saved Searches that are used in that Visualization. And then re-import those.

You could export everything and edit that JSON to contain only the things you want to import later.

Export does NOT export index patterns, so you would have to re-create any index patterns used by the Saved Searches and Visualizations using the same name as before.

On the clean installation, you should create the index pattern first, then import the saved objects.

Regards,
Lee

3

Thanks Lee,

Do you know how to import these directly to elastic search using curl?

I have created templates for index patterns which I load at installation of logstash.
I would like to do something similar for dashboards and visualizations.

curl -XPUT 'http://elasticsearch:9200/.kibana/visualization' -d@/tmp/my_visualization1.json
curl -XPUT 'http://elasticsearch:9200/.kibana/dashboard/' -d@/tmp/my_dashboard.json

But this does not work as is.
I suspect I need to modify the exports before importing them.

Thanks
Mathias

4

I think I found a way.

First get Vizualisations:

curl -XGET 'elasticsearch:9200/.kibana/visualization/Bytes/_source?pretty'
{
.
.
.
}

load the visualizations:

curl -XPUT 'elasticsearch:9200/.kibana/visualization/Bytes2' -d'{
.
.
.
}'

I did not find a way to get the dashboards.
I can search for them:
curl -XGET 'elasticsearch:9200/.kibana?scroll=10m&size=50&pretty'

But I can not get them:
curl -XGET 'elasticsearch:9200/.kibana/dashboard/vPDCP/_source&pretty'

So I decided to fetch them from Kibana GUI using the export function abd then load them with:

curl -XPUT 'elasticsearch:9200/.kibana/dashboard/vPDCP' -d'{
.
.
.
}'

If anyone knows how to get the dashboard document using curl, please let me know.

Thanks
Mathias

5

I'm able to get the _source of a dashboard like this;

GET .kibana/dashboard/_search
{
  "query": {
    "match": {"_id": "Packetbeat-Cassandra"}
  }
}

But the source is embedded in the whole response and you'd have to parse that out to be able to PUT it back in.

An alternative is a tool called elasticdump https://github.com/taskrabbit/elasticsearch-dump. This tool was not written by Elastic and is not supported, but I've used it and it works pretty well.

It makes it pretty easy to save the whole .kibana index and load it back in, or just one dashboard like this;

elasticdump --input=http://elastic:changeme@localhost:9200/.kibana --output=query.json --searchBody '{"query":{"term":{"_id": "Packetbeat-Cassandra"}}}'

This loads it back in;

elasticdump --output=http://elastic:changeme@localhost:9200/.kibana --input=query.json

Regards,
Lee

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.