Can I change the index pattern of a visualization in Kibana?

Question

I have created a full set of visualizations.Due to some reason I have to deleted that index in elastic. We need to create a new pattern of index. Problem is that after deleting index visualizations will not work . I will have to recreate it one by one painfully. Is there a way that I can go and edit visualization and just modify index pattern rather creating a new visualization itself.

Answer 1

Go to Settings->Objects->Visualizations and you can edit the definition manually.

Answer 2

First let's discuss WHY this whole issue is coming.

My environment is: Kibana v7.0.1 / 7+

This issue comes if you have created an Index-Pattern (using Kibana's GUI / website) instead of creating the same using ELK/Kibana's Saved Objects REST-API (ex: using Curl or some Python/Groovy script to call the rest api to create an index-pattern).

When you create an Index-Pattern using GUI, you basically

STEP 1: just type the name of the index and

STEP 2: a very important field called: Time Filter Field Name (aka "timeFieldName" which is used for generating / treating "EVENTS" available in indexed data (data is present in a matching Elasticsearch Index that you get for the pattern you provide in STEP 1).

Ex: If you create an index-pattern in Kibana by the name: jira-* then, it'll look for any available indexes in Elasticsearch where index starts with jira- (ex: jira-dev, jira-prod,.. jira-demo,..etc)

Anyways, once this is done via GUI, what we don't or are NOT allowed to specify is INDEX-PATTERN's ID value (which is very important and directly related to the ISSUE here).

When index-pattern is created in Kibana's GUI, ELK process assigns a random/unique Index-Pattern ID value to the newly created Index-Pattern that you created.

1. You can see that Index-Pattern's ID if you hover over you mouse on the index-pattern in GUI (under: Gear button > Index-Patterns > hover over an index-pattern and see in the status bar URL for ID value the last value after a / slash).

Next, you create the Visualization (where you tie what index-pattern you want to use) and later add visualizations to dashboards.

Cool: let's say, one day you accidentally delete this index-pattern (i.e. jira-* in Kibana) --or the index itself (Elasticsearch index i.e jira-dev).

In case: where you ended up deleting just the index (in Elasticsearch), you can re-create the index again with the same index name jira and the existing index-pattern i.e. jira-* will pick the newly created Elasticsearch index easily (you may have to click on the refresh button).

In case: you were lucky enough to delete the index-pattern (jira-* here), then that magical/hidden/auto-generated long alpha-numeric Index ID that was generated for free (will be deleted) and your visualization and dashboards (using such visualization) barf and your managers will definitely cry for some urgent help!

One work-around solution is: recreate the index-pattern jira-**. Find it's ID (you can use Saved Object's GET rest api on index-pattern to get this value) and then click on Gear button > under Saved Objects > search your visulization and see ID value in references JSON section and change the OLD alpha-numeric value (of the deleted jira- index with the new ID value of the newly created index-pattern. This will get you going.

Now, HOW to AVOID all this MESS: If you had created your index-pattern using Kibana's Saved Objects REST API then, it ALLOWS you to provide the ID value (the last value in the rest-api URL after /) which is HUMAN readable string name and what this means is: if you ever delete/lose the index-pattern and if re-create the same index-pattern then you'll NEVER EVER have to worry about these long auto-generated alpha-numeric ID values that Kibana GUI creates behind the scene and you don't have to change anything in your Visualizations/Dashbaords.

Ex: How to create an index-pattern in Kibana (v7.0.1 / 7+) is:

(venvPython375) [[email protected] myfolder]$ curl -X POST -u $user:$pass -H "Content-Type: application/json" -H "kbn-xsrf:true"  "${KIBANA_URL}/api/saved_objects/index-pattern/jira-index" -d '{ "attributes": { "title":"jira-*","timeFieldName":"sprint_start_date"}}'  -w "\n"|jq   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                  Dload  Upload   Total   Spent    Left  Speed 100   327  100   250  100    77    543    167 --:--:-- --:--:-- --:--:--   543 {   "type": "index-pattern",   "id": "jira-index",   "attributes": {     "title": "jira-*",     "timeFieldName": "start_of_work"   },   "references": [],   "migrationVersion": {     "index-pattern": "6.5.0"   },   "updated_at": "2020-02-25T22:56:44.531Z",   "version": "Wzg5NCwxNV0=" } 

NOTICE: "id": "jira-index", this is important and is HUMAN READABLE (ID) value for the index you just created.

You basically created a index-pattern by the name (see TITLE value) i.e. jira-* and it's ID value is: jira-index (HUMAN readable), this ID value is easier to maintain, remember and to be used in GET operations! (Now you don't have to remember the long dynamically generated ID that you got when you were creating the index-pattern in Kibana's GUI/web-page).

To see an Index-Pattern, now you can use the HUMAN readable ID value to see it, rather than some long alpha-numeric ID.

curl -X GET "${KIBANA_URL}/api/saved_objects/index-pattern/jira-index" | jq 

Now, if you create a new visualization and use "jira-" as index-pattern and if you ever delete the index-pattern, then recreating the same jira- pattern with title/name as "jira-*" will always keep "jira-index" as it's ID (and because your visualization was using the HUMAN readable ID and which got created after an accidental delete / recreated if you wanted to), you'll NEVER lose your data or EVER have to delete or recreate your Visualizations/Dashboards!, therefore it's like Merry X-mas baeby!!

For information about Index-Patterns (how to get human readable Index-Pattern ID), see here: https://stackoverflow.com/a/60404691/1499296