Update/Change Kibana Visualization Index Pattern

|
Last Updated:
|
|

In this tutorial, you will learn how to update/change kibana visualization index pattern. Kibana is a free and open user interface that lets you visualize your Elasticsearch data and navigate the Elastic Stack. Sometimes, the index pattern in which you use to visualize your various event data on Kibana may change for some reasons. This usually leads to being unable to visualize the data.

See example errors below in the screenshot below that results due to the changes on the Kibana index patterns.

Sample dashboard errors;

Could not locate that index-pattern
kibana could not locate index pattern
Saved object is missing
Update/Change Kibana Visualization Index Pattern

Changing Kibana Visualization Index Pattern

So how can you change Kibana visualization index pattern? Visualization is usually based on the fields extracted from the indexed event data. So assuming that, the index from which you created the pattern from still exists and that the fields on the event data have not changed, you can easily change the visualization index pattern and continue enjoying Kibana visualizations.

There are two methods you can use to update the visualization index pattern depending on the number of visualizations you already have.

  1. Changing the index pattern ID under the Saved Object settings if you have few visualizations
  2. Exporting the visualization json file and recursively change the index pattern ID and re-import

Updating Index Pattern ID under Saved Object settings

If you have fewer visualizations, it is easier to update their index pattern id via the Saved Object settings.

To access Kibana Saved Object settings, navigate to Kibana Management > Stack Management > Kibana > Saved Objects.

Search for the specific visualization that you need to update the index pattern, see example below.

kibana saved object settings

Click on the visualization in question to edit it and update/change the index pattern name.

On the edit page, scroll down to references section.

edit kibana visualization

Delete the index ID, which in the screenshot above is, 59ff9b10-d27d-11ea-99f7-c5571c2fcad7, and replace it with the new index pattern name.

You can obtain the new index pattern from the URL. simply navigate to Management > Stack Management > Kibana > Index Pattern > Click on the appropriate index pattern > Obtain the ID from URL.

kibana index pattern

Copy the index pattern ID from the URL and replace it on the visualization editing page;

new index pattern

Once done, click Save visualization Object to update the Kibana visualization index pattern ID.

You visualization should now be restored.

Exporting Visualization Json file

If you have a huge number of visualizations that uses the same index and you need to update or change their index patterns, simply;

  • Navigate to Kibana Management > Stack Management > Kibana > Saved Objects.
  • Search for the respective visualizations that you need to update their index patterns.
  • Select all the visualizations to be updated.
  • Click Export button to export the Visualization JSON file.
  • Once the JSON file is downloaded, open it with your preferred editor
  • Search for and recursively replace the old Index pattern ID with the new Index Pattern ID.
  • Save the new JSON file.
  • Head back to Kibana Management > Stack Management > Kibana > Saved Objects > Click import > Select the updated JSON file > enable Automatically overwrite all saved objects? > Import.
  • Click Done after successful Import.

You should now have updated the Kibana visualization index pattern and restored your visualizations.

Reference

Change index name in visualization

Other Tutorials

Configure ELK Stack Alerting with ElastAlert

Monitor Linux System Metrics with ELK Stack

Visualize WordPress User Activity Logs on ELK Stack

Process and Visualize ModSecurity Logs on ELK Stack

SUPPORT US VIA A VIRTUAL CUP OF COFFEE

We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
gen_too
Co-founder of Kifarunix.com, Linux Tips and Tutorials. Linux/Unix admin and author at Kifarunix.com.

Leave a Comment