Programmatically set Kibana's default index pattern

Question

A Kibana newbie would like to know how to set default index pattern programmatically rather than setting it on the Kibana UI through web browser during the first time viewing Kibana UI as mentioned on page https://www.elastic.co/guide/en/kibana/current/setup.html

Answer 1

In kibana:6.5.3 this can be achieved this calling the kibana api.

curl -X POST "http://localhost:5601/api/saved_objects/index-pattern/logstash" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "attributes": {
    "title": "logstash-*",
    "timeFieldName": "@timestamp"
  }
}
'

the Docs are here it does mention that the feature is experimental.

Answer 2

Elasticsearch stores all Kibana metadata information under .kibana index. Kibana configurations like defaultIndex and advance settings are stored under index/type/id .kibana/config/4.5.0 where 4.5.0 is the version of your Kibana.

So you can achieve setting up or changing defaultIndex with following steps:

1. Add index to Kibana which you want to set as defaultIndex. You can do that by executing following command:

   curl -XPUT http://<es node>:9200/.kibana/index-pattern/your_index_name -d '{"title" : "your_index_name",  "timeFieldName": "timestampFieldNameInYourInputData"}'
   

2. Change your Kibana config to set index added earlier as defaultIndex:

   curl -XPUT http://<es node>:9200/.kibana/config/4.5.0 -d '{"defaultIndex" : "your_index_name"}'
   

Note: Make sure your giving correct index_name everywhere, valid timestamp field name and kibana version for example if you are using kibana 4.1.1 then you can replace 4.5.0 with 4.1.1 .