Unable to see the Kibana object I have curlPUT-ed

[vincent-fuchs]

HI,

I am using ES and Kibana 6.0.0. At Kibana startup, I would like to push some objects (search, viz, dashboard) in .kibana index in ES.

I am doing a PUT .kibana/doc/my_warns_and_errors with below doc :

    {
"type": "search",
   "search":{
    "title": "WARN and ERROR logs",
    "description": "some description",
    "hits": 0,
    "columns": [
      "service.name",
      "level",
      "message",
      "@timestamp"
    ],
    "sort": [
      "@timestamp",
      "desc"
    ],
    "kibanaSavedObjectMeta": {
      "searchSourceJSON": "{\"index\":\"a611cf80-d10b-11e7-a59c-9b949ad6a836\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"(level:WARN OR level:ERROR)\"},\"filter\":[]}"
    }
   }
}

I get a 200 OK response, saying document was updated.

When I go to Kibana and look at the searches, I find it, but all fields are empty. I have tried exporting existing searches that I created manually, but I am not able to tweak the json documents so that I am able to repush them through a curl PUT.

What should be the format of the document to push, so that I am then able to use it in Kibana ?

Thanks !

[thomasneirynck]

hi @vincent-fuchs

what happens when you read out the document, does it look as expected?

GET .kibana/doc/my_warns_and_errors

[vincent-fuchs]

yes, I guess it looks like it should :

{
    "_index": ".kibana",
    "_type": "doc",
    "_id": "my_warns_and_errors",
    "_version": 1,
    "found": true,
    "_source": {
        "type": "search",
        "search": {
            "title": "WARN and ERROR logs",
            "description": "some description",
            "hits": 0,
            "columns": [
                "service.name",
                "level",
                "message",
                "@timestamp"
            ],
            "sort": [
                "@timestamp",
                "desc"
            ],
            "kibanaSavedObjectMeta": {
                "searchSourceJSON": "{\"index\":\"a611cf80-d10b-11e7-a59c-9b949ad6a836\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"(level:WARN OR level:ERROR)\"},\"filter\":[]}"
            }
        }
    }
}

But when I go to Kibana -> Management -> Saved Objects -> Searches, I see my search (the title shows up in the list). When I click on it to see the search details, all fields are empty : title, description, column, hits, sort, version.. and kibanaSavedObjectMeta.searchSourceJSON contains only empty curly braces

[vincent-fuchs]

Nobody has any clue ? Am I really the only one trying to do this out there ?