Skill: chunkin616-hue/kibana-data-views (version 1.0.0)

--- name: kibana-data-views description: "Manage Kibana Data Views (formerly index patterns) via REST API. Use when: (1) Creating, listing, updating, or deleting data views, (2) Checking data view existence before dashboard creation, (3) Troubleshooting missing index patterns, (4) Programmatically managing Kibana index patterns. API endpoints: POST /api/data_views, GET /api/data_views, GET /api/data_views/{viewId}, PUT /api/data_views/{viewId}, DELETE /api/data_views/{viewId}." --- # Kibana Data Views API Skill Manage Kibana Data Views (formerly "index patterns") via the Kibana REST API. ## Base URL ``` http://<kibana-host>/api/data_views ``` For Omni-Monitor: `http://192.168.99.43/api/data_views` ## Authentication Kibana API requires `kbn-xsrf: true` header. For authenticated requests, use Kibana's session cookie or Basic auth. --- ## API Endpoints ### 1. List All Data Views ``` GET /api/data_views ``` **Response:** ```json { "data_views": [ { "id": "...", "title": "zbx-metrics-*", "name": "Zabbix Metrics", "timeFieldName": "@timestamp" } ] } ``` ### 2. Get a Data View ``` GET /api/data_views/{viewId} ``` **Path Parameters:** - `viewId` (string, required): Data view identifier **Response 200:** ```json { "data_view": { "id": "...", "title": "zbx-metrics-*", "name": "Zabbix Metrics", "timeFieldName": "@timestamp", "fields": {...} } } ``` ### 3. Create a Data View ``` POST /api/data_views/data_view ``` **Headers:** - `kbn-xsrf: true` (required) - `Content-Type: application/json` **Request Body:** ```json { "data_view": { "title": "zbx-metrics-*", "name": "Zabbix Metrics", "timeFieldName": "@timestamp", "allowNoIndex": true } } ``` **Response 200:** Returns created data_view object **Response 400:** Bad request (e.g., duplicate title) ### 4. Update a Data View ``` PUT /api/data_views/{viewId} ``` **Path Parameters:** - `viewId` (string, required): Data view identifier **Request Body:** ```json { "data_view": { "title": "zbx-metrics-*", "name": "Zabbix Metrics Updated", "timeFieldName": "@timestamp" } } ``` ### 5. Delete a Data View ``` DELETE /api/data_views/{viewId} ``` **Headers:** - `kbn-xsrf: true` (required) **Response 204:** Successfully deleted **Response 404:** Data view not found ### 6. Check if Data View Exists (by title) ``` GET /api/data_views ``` Then search results for matching title. ### 7. Validate Index Pattern ``` POST /api/data_views/validate ``` Check if indices exist without creating a data view. --- ## Common Data View Titles for Omni-Monitor | Title | Description | |-------|-------------| | `zbx-metrics-*` | Zabbix CPU/Memory/Disk metrics | | `zbx-hosts-*` | Zabbix hosts | | `zbx-problems-*` | Zabbix problems | | `zbx-triggers-*` | Zabbix triggers | | `k8s-pod-logs-*` | K8s pod logs | | `k8s-audit-logs-*` | K8s audit logs | | `vm-system-logs-*` | VM system logs | | `ingress-nginx-logs-*` | Ingress nginx logs | | `*-logs-*` | All logs | --- ## Usage with Kibana Proxy When accessing Kibana API from external tool, you may need to proxy through Kibana: ``` http://192.168.99.43/api/console/proxy?path=<encoded-path>&method=<GET|POST|PUT|DELETE> ``` Example - List data views via proxy: ``` GET http://192.168.99.43/api/console/proxy?path=%2Fapi%2Fdata_views&method=GET ``` --- ## Troubleshooting Lens "indexpattern" Errors If Lens fails with error `Cannot read properties of undefined (reading 'indexpattern')`: 1. **Check if data view exists:** ```bash curl -s "http://192.168.99.43/api/data_views" \ -H "kbn-xsrf: true" ``` 2. **Check data view ID matches what dashboard references:** - Dashboard references contain `indexpattern-datasource-layer-<uuid>` references - The uuid must match a real data view ID 3. **Recreate missing data view:** ```bash curl -X POST "http://192.168.99.43/api/data_views/data_view" \ -H "kbn-xsrf: true" \ -H "Content-Type: application/json" \ -d '{ "data_view": { "title": "zbx-metrics-*", "name": "Zabbix Metrics", "timeFieldName": "@timestamp", "allowNoIndex": true } }' ``` 4. **Check .kibana index health:** ```bash # Query from within k8s cluster kubectl exec -n elastic elasticsearch-0 -- curl -s -u 'elastic:Changeme123' \ 'http://localhost:9200/.kibana/_search?size=100' \ -H 'Content-Type: application/json' \ -d '{"query": {"prefix": {"type": "index-pattern"}}}' ``` --- ## Scripts | Script | Purpose | |--------|---------| | `list_data_views.py` | List all data views from Kibana | | `create_data_view.py` | Create a new data view | | `delete_data_view.py` | Delete a data view | | `check_and_fix_data_views.py` | Diagnose and fix missing data views | --- ## See Also - [kibana-lens-builder](../kibana-lens-builder/SKILL.md) - Create Lens visualizations and dashboards


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)