OpenSearch: How to Update index-pattern in “Broken” Visualization

[post-views]
December 05, 2024 · 1 min read
OpenSearch: How to Update index-pattern in “Broken” Visualization

If index-pattern was recreated and its id hasn’t been customized to the same as it was before, you’ll get an error in all related visualizations:

Could not locate that index-pattern (id: index-pattern_id), click here to re-create it

The link will lead you to the index-pattern creation menu.
 

But there is no need to recreate the index-pattern or visualization from scratch. You can just update it with a new index-pattern_id
Just go to Dashboards Management -> Saved objects and find your visualization. When you click on it, it will show you the JSON configuration of the viz.
In the references block, you can update the id field with the new index-pattern_idand just save the visualization.

If you have a whole dashboard full of “broken” visualizations, you can update them all at once.
In the Saved objects menu, find your dashboard. Then, use the export button and choose include related objects option to download the dashboard in JSON format with all related visualizations.
Find the id field under all referenceslists and just change all visualizations index-pattern_idto a new one.
Then, import the updated file into OpenSearch.

Was this article helpful?

Like and share it with your peers.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Related Posts