In this tutorial, you will learn how to update/change kibana visualization index pattern. Kibana is a free and open user interface that lets you visualize your Elasticsearch data and navigate the Elastic Stack. Sometimes, the index pattern in which you use to visualize your various event data on Kibana may change for some reasons. This usually leads to being unable to visualize the data.
See example errors below in the screenshot below that results due to the changes on the Kibana index patterns.
Sample dashboard errors;
Could not locate that index-pattern
Saved object is missing
Changing Kibana Visualization Index Pattern
So how can you change Kibana visualization index pattern? Visualization is usually based on the fields extracted from the indexed event data. So assuming that, the index from which you created the pattern from still exists and that the fields on the event data have not changed, you can easily change the visualization index pattern and continue enjoying Kibana visualizations.
There are two methods you can use to update the visualization index pattern depending on the number of visualizations you already have.
- Changing the index pattern ID under the Saved Object settings if you have few visualizations
- Exporting the visualization json file and recursively change the index pattern ID and re-import
Updating Index Pattern ID under Saved Object settings
If you have fewer visualizations, it is easier to update their index pattern id via the Saved Object settings.
To access Kibana Saved Object settings, navigate to Kibana Management > Stack Management > Kibana > Saved Objects.
Search for the specific visualization that you need to update the index pattern, see example below.
Click on the visualization in question to edit it and update/change the index pattern name.
On the edit page, scroll down to references section.
Delete the index ID, which in the screenshot above is, 59ff9b10-d27d-11ea-99f7-c5571c2fcad7, and replace it with the new index pattern name.
You can obtain the new index pattern from the URL. simply navigate to Management > Stack Management > Kibana > Index Pattern > Click on the appropriate index pattern > Obtain the ID from URL.
Copy the index pattern ID from the URL and replace it on the visualization editing page;
Once done, click Save visualization Object to update the Kibana visualization index pattern ID.
You visualization should now be restored.
Exporting Visualization Json file
If you have a huge number of visualizations that uses the same index and you need to update or change their index patterns, simply;
- Navigate to Kibana Management > Stack Management > Kibana > Saved Objects.
- Search for the respective visualizations that you need to update their index patterns.
- Select all the visualizations to be updated.
- Click Export button to export the Visualization JSON file.
- Once the JSON file is downloaded, open it with your preferred editor
- Search for and recursively replace the old Index pattern ID with the new Index Pattern ID.
- Save the new JSON file.
- Head back to Kibana Management > Stack Management > Kibana > Saved Objects > Click import > Select the updated JSON file > enable Automatically overwrite all saved objects? > Import.
- Click Done after successful Import.
You should now have updated the Kibana visualization index pattern and restored your visualizations.
Reference
Change index name in visualization
Other Tutorials
Configure ELK Stack Alerting with ElastAlert
Monitor Linux System Metrics with ELK Stack
