dashboards for older ELK versions

[sangdrax8]

I am currently running 7.10, and when importing the dashboard I fail on a few of them due to it saying

he file could not be processed due to error: "Unprocessable Entity: Document "e895c9b0-3a99-11eb-96b2-e765737b7534" has property "visualization" which belongs to a more recent version of Kibana [7.11.0]. The last known version is [7.10.0]"

Are there exports of these dashboards for any older versions so I can just import one for mine? Or ... is there some conversion tool I don't know about that can make them compatible?

[revere521]

Is there a reason you wouldn't want to upgrade the ELK stack to current?

[sangdrax8]

I guess importing my pfsense logs into the existing setup seemed like less intrusive of an operation than upgrading everything.

[revere521]

You should be able to pretty painlessly upgrade the ELK stack with your package manager.  Between 7.10 and 7.13 there shouldnt be any breaking changes for this project.On Jun 22, 2021 4:31 PM, sangdrax8 ***@***.***> wrote: I guess importing my pfsense logs into the existing setup seemed like less intrusive of an operation than upgrading everything. —You are receiving this because you commented.Reply to this email directly, view it on GitHub, or unsubscribe.

[sangdrax8]

AHH, so I tried to upgrade, and I just now realized I am actually using Open Distro, which is fully upgraded at this time. I am running a demo stack from another security project I wanted to test out, and I wanted to add this pfsense log into it as well. It seems Kibana 7.10.2 was the last version where they were the same code base.

I can't imagine much has changed since everything else is running as expected. I just don't know what makes the dashboards not import from one version to another? Would it be possible to support both projects with just a dashboard tweak? I'll look around, but since I haven't ever seen pfelk's dashboards before in person, I am not really sure what pieces might not be working for the import.

[revere521]

It unfortunately looks like the actual visualization that is included in the dashboard is from a newer version of Kibana, and the dashboards would need to be re-authored to remove the visualization in question (one of the actual dashboard widgets possibly, or all of them?) and replace them with ones from an earlier version. In the repo there should be some earlier version dashboards that may work - but you will need all the underlying config files, etc. to feed them data.

Mixing this project with another project may not be extremely straightforward, although not impossible.

[a3ilson]

@sangdrax8 - the current dashboards have lens elements which are not compatible with the OSS variant - there may be other differences too. I have an older video that walks through the process of creating visualizations + dashboard. I may add that too my list as they can be intimidating but once you figure it out, they can be created fairly easy.

[a3ilson]

This appears to be similar to issue #319