Unable to import dashboard with script and UI

[2rock (Hub)]

Hello,

I juste installed ELK stack, on just one server. And a sent log with metricbeat and filebeat from another server.

Everything is ok. But when I want to import dashboard I run the script and it seems to be good :

Create temporary directory /tmp/tmp693935868 Downloading https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.2.2.zip Unzip archive /tmp/tmp693935868 /tmp/tmp693935868/beats-dashboards-5.2.2/filebeat Import directory /tmp/tmp693935868/beats-dashboards-5.2.2/filebeat/index-pattern Import index to /.kibana/index-pattern/filebeat-* from /tmp/tmp693935868/beats-dashboards-5.2.2/filebeat/index-pattern/filebeat.json No directory /tmp/tmp693935868/beats-dashboards-5.2.2/filebeat/dashboard /tmp/tmp693935868/beats-dashboards-5.2.2/heartbeat /tmp/tmp693935868/beats-dashboards-5.2.2/metricbeat /tmp/tmp693935868/beats-dashboards-5.2.2/packetbeat /tmp/tmp693935868/beats-dashboards-5.2.2/winlogbeat

But in Kibana there is nothing...

When I tried to use the UI import button it's the same, none of the files I tried works.

So I look into the json files in the beats-dashboards-5.2.2.zip to see the structure and it's a bit different to the structure of an exported dashboard (same for visualization and search)

Exemple of an exported dashboard :

[code][
{
"_id": "97115520-13ea-11e7-9dcf-33e967d4d9f5",
"_type": "dashboard",
"_source": {
"hits": 0,
"timeRestore": false,
"description": "",
"uiStateJSON": "{"P-2":{"vis":{"params":{"sort":{"columnIndex":null,"direction":null}}}},"P-4":{"vis":{"params":{"sort":{"columnIndex":null,"direction":null}}}},"P-5":{"vis":{"params":{"sort":{"columnIndex":null,"direction":null}}}}}",
"panelsJSON": "[{"col":4,"id":"Container-CPU-usage","panelIndex":2,"row":1,"size_x":9,"size_y":4,"type":"visualization"},{"col":1,"id":"System-Navigation","panelIndex":3,"row":1,"size_x":3,"size_y":4,"type":"visualization"},{"col":1,"id":"Container-Memory-stats","panelIndex":4,"row":5,"size_x":12,"size_y":3,"type":"visualization"},{"col":1,"id":"Container-Block-IO","panelIndex":5,"row":8,"size_x":12,"size_y":4,"type":"visualization"}]",
"title": "CPU/Memory per container",
"optionsJSON": "{"darkTheme":false}",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"filter":[{"query":{"query_string":{"query":"*","analyze_wildcard":true}}}]}"
}
}
}

][/code]

Exemple of a dasboard in the zip file:

{ "hits": 0, "timeRestore": false, "description": "", "uiStateJSON": "{\"P-2\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-4\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}},\"P-5\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}", "panelsJSON": "[{\"col\":4,\"id\":\"Container-CPU-usage\",\"panelIndex\":2,\"row\":1,\"size_x\":9,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"System-Navigation\",\"panelIndex\":3,\"row\":1,\"size_x\":3,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"Container-Memory-stats\",\"panelIndex\":4,\"row\":5,\"size_x\":12,\"size_y\":3,\"type\":\"visualization\"},{\"col\":1,\"id\":\"Container-Block-IO\",\"panelIndex\":5,\"row\":8,\"size_x\":12,\"size_y\":4,\"type\":\"visualization\"}]", "title": "CPU/Memory per container", "optionsJSON": "{\"darkTheme\":false}", "version": 1, "kibanaSavedObjectMeta": { "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}]}" } }

It's juste the source part. The id and type part are missing. Is it possible that this is the reason of my problem?

[tsullivan (Tim Sullivan)]

@2rock

But in Kibana there is nothing...

It looks like you ran the import_dashboard script from the Filebeat install path, and it seems to be expected that all that does is install an index pattern (for filebeat-*). I guess the name of the script is misleading. I tried out running Filebeat's import script and it looks like I got the same output you saw.

Since you have metricbeat as well, try running the import script that's located in the Metricbeat install path. That should create some actual saved searches, visualizations and dashboards. I ran the Metricbeat install script, I saw much more output. Too much to put here

@2rock

It's juste the source part. The id and type part are missing. Is it possible that this is the reason of my problem?

The script programmatically installs the objects into the .kibana index. _id is generated automatically by Elasticsearch, and _type is part of the query URL of the POST request. The source you're looking at is just the JSON body used for the POST request.