How to change change Kibana saved search (Discover

Question

I have query for searching specific occurrences in Kibana, this query is saved among other searches, is there a way I can change it programmatically via for example a REST call?

Answer 1

Everything is stored in .kibana index and you can update your settings by a put request into elasticsearch but it's not recommended.
You can edit your saved search in kibana/settings/objects.

Answer 2

As @Mohammad said, All metadata related to Kibana is stored under .kibana index in elasticsearch cluster. All searches, visualization, dashboards are stored in their respective types in .kibana index. e.g searches are stored under search type in .kibana index.

Get all searches by executing following command:

GET /.kibana/search/_search
{
  "query": {
    "match_all": {}
  }
}

Retrieve search-id for which you want to update the query from the above results.

Now you can update that specific search document by using _update API as shown below:

POST /.kibana/search/<search-id>/_update
{
   "doc" : {
      "kibanaSavedObjectMeta":{ "searchSourceJSON": """{"index":"test-*","query":{"query_string":{"query":"id:2","analyze_wildcard":true}},"filter":[],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647}}"""
   }
   }
}

Consider the following warning message from Kibana if you are not advanced user:

Proceed with caution!

Modifying objects is for advanced users only. Object properties are not validated and invalid objects could cause errors, data loss, or worse. Unless someone with intimate knowledge of the code told you to be in here, you probably shouldn’t be.