Update/Change Kibana Visualization Index Pattern

0
982

In this tutorial, you will learn how to update/change kibana visualization index pattern. Kibana is a free and open user interface that lets you visualize your Elasticsearch data and navigate the Elastic Stack. Sometimes, the index pattern in which you use to visualize your various event data on Kibana may change for some reasons. This usually leads to being unable to visualize the data.

See example errors below in the screenshot below that results due to the changes on the Kibana index patterns.

Sample dashboard errors;

Could not locate that index-pattern
Update/Change Kibana Visualization Index Pattern
Saved object is missing
Update/Change Kibana Visualization Index Pattern

Update/Change Kibana Visualization Index Pattern

So how can you update/change Kibana visualization index pattern? Visualization is usually based on the fields extracted from the indexed event data. So assuming that, the index from which you created the pattern from still exists and that the fields on the event data have not changed, you can easily update/change kibana visualization index pattern and continue enjoying Kibana visualizations.

There are two methods in which you can update/change kibana visualization index pattern depending on the number of visualizations you already have.

  1. Changing the index pattern ID under the Saved Object settings if you have few visualizations
  2. Exporting the visualization json file and recursively change the index pattern ID and re-import

Update/Change Kibana Visualization Index Pattern by Updating Index Pattern ID under Saved Object settings

If you have fewer visualizations, it is easier to update their index pattern id via the Saved Object settings.

To access Kibana Saved Object settings, navigate to Kibana Management > Stack Management > Kibana > Saved Objects.

Search for the specific visualization that you need to update the index pattern, see example below.

Update/Change Kibana Visualization Index Pattern

Click on the visualization in question to edit it and update/change the index pattern name.

On the edit page, scroll down to references section.

Update/Change Kibana Visualization Index Pattern

Delete the index ID, which in the screenshot above is, 59ff9b10-d27d-11ea-99f7-c5571c2fcad7, and replace it with the new index pattern name.

You can obtain the new index pattern from the URL. simply navigate to Management > Stack Management > Kibana > Index Pattern > Click on the appropriate index pattern > Obtain the ID from URL.

Update/Change Kibana Visualization Index Pattern

Copy the index pattern ID from the URL and replace it on the visualization editing page;

Update/Change Kibana Visualization Index Pattern

Once done, click Save visualization Object to update the Kibana visualization index pattern ID.

You visualization should now be restored.

Update/Change Kibana Visualization Index Pattern by Exporting Visualization Json file

If you have a huge number of visualizations that uses the same index and you need to update or change their index patterns, simply;

  • Navigate to Kibana Management > Stack Management > Kibana > Saved Objects.
  • Search for the respective visualizations that you need to update their index patterns.
  • Select all the visualizations to be updated.
  • Click Export button to export the Visualization JSON file.
  • Once the JSON file is downloaded, open it with your preferred editor
  • Search for and recursively replace the old Index pattern ID with the new Index Pattern ID.
  • Save the new JSON file.
  • Head back to Kibana Management > Stack Management > Kibana > Saved Objects > Click import > Select the updated JSON file > enable Automatically overwrite all saved objects? > Import.
  • Click Done after successful Import.

You should now have updated the Kibana visualization index pattern and restored your visualizations.

That marks the end of our tutorial on how to update/change Kibana visualization index pattern ID.

Reference

Change index name in visualization

Other Tutorials

Configure ELK Stack Alerting with ElastAlert

Monitor Linux System Metrics with ELK Stack

Visualize WordPress User Activity Logs on ELK Stack

Process and Visualize ModSecurity Logs on ELK Stack

LEAVE A REPLY

Please enter your comment!
Please enter your name here