Programmatically set Kibana's default index pattern

Question

A Kibana newbie would like to know how to set default index pattern programmatically rather than setting it on the Kibana UI through web browser during the first time viewin

Answer 1

Elasticsearch stores all Kibana metadata information under .kibana index. Kibana configurations like defaultIndex and advance settings are stored under index/type/id .kibana/config/4.5.0 where 4.5.0 is the version of your Kibana.

So you can achieve setting up or changing defaultIndex with following steps:

1. Add index to Kibana which you want to set as defaultIndex. You can do that by executing following command:

   curl -XPUT http://<es node>:9200/.kibana/index-pattern/your_index_name -d '{"title" : "your_index_name",  "timeFieldName": "timestampFieldNameInYourInputData"}'
   

2. Change your Kibana config to set index added earlier as defaultIndex:

   curl -XPUT http://<es node>:9200/.kibana/config/4.5.0 -d '{"defaultIndex" : "your_index_name"}'
   

Note: Make sure your giving correct index_name everywhere, valid timestamp field name and kibana version for example if you are using kibana 4.1.1 then you can replace 4.5.0 with 4.1.1 .

Answer 2

In kibana:6.5.3 this can be achieved this calling the kibana api.

curl -X POST "http://localhost:5601/api/saved_objects/index-pattern/logstash" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "attributes": {
    "title": "logstash-*",
    "timeFieldName": "@timestamp"
  }
}
'

the Docs are here it does mention that the feature is experimental.