elasticsearchkibanakibana-4

Switch time field for index pattern in kibana without loosing scripted fields or field formatting

When a time-based index is added to kibana, you have to pick the field that will act as a time field. If you want to switch from one field to another, normally I would delete the index and re-add it back. But you end up loosing scripted fields and filed formatting this way.

Is there any way to modify the existing index time field without loosing scripted fields/formatting?

It can probably be done by messing around directly with /.kibana/index-pattern/index_pattern_name but all my attempts with changing timeFieldName directly ended up dropping scripted fields.

Solution

  • The easiest way seems to update the corresponding document:

    POST /.kibana/index-pattern/YOUR_INDEX_NAME/_update
{
    "doc": {
        "timeFieldName": "NEW_TIME_FIELD_NAME"
    }
}

    It should preserve scripted fields.