Where does the export saved Object API put the exported objects?

[mykael (Michael Clarke)]

OK, used curl to drive the saved object export api:

curl -X POST "localhost:9200/api/saved_objects/_export" -H "kbn-xsrf: true" -H "Content-Type: application/json" -d "{ \"objects\": [ { \"type\": \"dashboard\" } ], \"includeReferencesDeep\": true }"

Basically dumping out all of the dashboards and everything that feeds into them.

I get back a response saying it's done it, but where is the file holding the exported objects? When I do it through my web browser I get a new file - exported.ndjson - downloaded, but all curl is giving me is a 'great done it!'.

[warkolm (Mark Walkom)]

It'll usually save it in the directory you ran the command from.

[mykael (Michael Clarke)]

Nope, no sign of any new files.

The response is:

{"_index":"api","_type":"saved_objects","_id":"_export","_version":5,"result":"updated","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":4,"_primary_term":1}

There are definitely some dashboards loaded into Kibana.

Any guesses as to what the filename would be? If I add a -o to curl, I just get the response written to a file...

I'm sending it to port 9200. If I try sending it to 5601 - as the manual indicates - I get:

{"statusCode":400,"error":"Bad Request","message":"Invalid request payload JSON format"}

[warkolm (Mark Walkom)]

Ahh ok.

You need to be talking to the Kibana host/IP, which uses port 5601, not Elasticsearch, which uses port 9200. If you talk to Elasticsearch with that query, you are actually creating/updating a document in an index called api. Which is what that response is saying. You should be able verify that by checking with _cat/indices?v.

You should also be using the -o flag for curl as you mention, I did forget that part myself