Welcome dashboard rebuild

I accidentally overwrote the default RockNSM Welcome dashboard and was wondering if someone could post a screenshot so I could replicate/rebuild.

I am new to elastic stack, so if there is a way to export your dashboard and help me import, that could work also. I am happy to rebuild, just want to know what was on the dashboard before.

Thanks.

Anybody have a screenshot they can share or the actual dashboard? I will rebuild if I had a screenshot.

Thanks.

@water

I think the best option would be to run the import script.

git clone git@github.com:rocknsm/rock-dashboards.git
cd rock-dashboards/ecs-configuration/kibana/
sudo sh import-saved-items.sh

Take a look at the script to see if you need to change anything (like the IP of Kibana) and it should just recreate (or updates) everything.

@Andy

I tried this. I am stuck because I have turned on Elastic security, so I need to figure out how to make that work with the scrpt.

I had to make a slight change to the URL you gave. I used:
git clone https://github.com/rocknsm/rock-dashboards.git

Any ideas on how to use the script with Elastic Security, how do I supply the credentials?

Cheers.

Here are my error messages:

Overwriting visualization named 57d74410-7631-11e7-b00e-1790f4f56ffc
Failed updating visualization named 57d74410-7631-11e7-b00e-1790f4f56ffc.ndjson:
{“statusCode”:401,“error”:“Unauthorized”,“message”:“Unauthorized”}

By default, that script uses http://127.0.0.1:5601 as the URL. You can change that as a parameter to the script. For example,

./import-saved-items.sh http://elastic:crazy_good_password@127.0.0.1:5601

Make sure you don’t have a trailing slash, I’ve made that mistake a lot. Kibana API is very sensitive to where slashes are.

1 Like

@dcode and @Andy

That you both! With the URL change and password inclusion and I have my dashboards back!!

Thank you very much.

Cheers.

2 Likes

Summarizing the solution:
git clone https://github.com/rocknsm/rock-dashboards.git
cd rock-dashboards/ecs-configuration/kibana/
sudo sh import-saved-items.sh http://elastic:crazy_good_password@127.0.0.1:5601

And that brought my missing dashboard back.

Side note, I found a bug in the Welcome dashboard: the “Zeek Notices” dashboard link was called incorrectly, so I fixed that tile in the dashboard by copy/paste of the correct URL and now that links properly.

Cheers.

1 Like