Dashboard with id x not found

This post is older than a year. Consider some information might not be accurate anymore.

Used:   elasticsearch v5.6.8  kibana v5.6.8 

X-Pack Reporting allows to automate and generate daily reports on pre-existing dashboards or visualizations in Kibana. To keep security tight I have created a reporting user. The first run with the reporting user gave me some mystery. Reporting complained Dashboard with id 'AWLOnWVZLaWygeBEGxLJ' not found. I did some digging and found the reason, which I am going to elaborate about in this post.

Use-Case Scenario

My watch watches for failed watches. Watcher itself is powerful but IMHO not very good for business users. You need deep or average knowledge about Elasticsearch in order to get it right. We have a couple of watches which failed from time to time. In my automation as Elasticsearch Admin I have to keep an eye on that.

The watch:

GET /_xpack/watcher/watch/failed_watches

{
"watch": {
    "trigger": {
      "schedule": {
        "daily": {
          "at": [
            "01:30"
          ]
        }
      }
    },
    "input": {
      "none": {}
    },
    "condition": {
      "always": {}
    },
    "actions": {
      "email_developers": {
        "email": {
          "profile": "standard",
          "attachments": {
            "count_report.pdf": {
              "reporting": {
                "url": "https://cinhtau.net/api/reporting/generate/dashboard/AWLOnWVZLaWygeBEGxLJ?_g=(time:(from:now-1d%2Fd,mode:quick,to:now))",
                "auth": {
                  "basic": {
                    "username": "reporting_wotscher",
                    "password": "guess-what"
                  }
                }
              }
            }
          },
          "to": [
            "le-mapper@cinhtau.net"
          ],
          "subject": "Failed Watches"
        }
      }
    }
  }
}

Kibana Object

First thought was ok, let’s check if dashboard has the respective id or can be found. Search in your kibana index. The default is .kibana.

POST /.kibana/_search
{
  "query": { "ids": { "values": ["AWLOnWVZLaWygeBEGxLJ" ] } }
}

If you get a similar output it is there.

{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 1,
    "hits": [
      {
        "_index": ".kibana",
        "_type": "dashboard",
        "_id": "AWLOnWVZLaWygeBEGxLJ",
        "_score": 1,
        "_source": {
          "title": "Report Failed Watches",
          "hits": 0,
          "description": "",
          "panelsJSON": """[{"size_x":3,"size_y":3,"panelIndex":1,"type":"visualization","id":"Watcher-Duration","col":4,"row":1},{"size_x":6,"size_y":3,"panelIndex":2,"type":"visualization","id":"fa7e4420-4080-11e7-ab57-7554a52ae433","col":7,"row":1},{"size_x":3,"size_y":3,"panelIndex":3,"type":"visualization","id":"Watches-Done","col":1,"row":1}]""",
          "optionsJSON": """{"darkTheme":false}""",
          "uiStateJSON": """{"P-1":{"vis":{"defaultColors":{"0 - 100":"rgb(0,104,55)"}}},"P-2":{"vis":{"params":{"sort":{"columnIndex":null,"direction":null}}}},"P-3":{"vis":{"defaultColors":{"0 - 100":"rgb(0,104,55)"}}}}""",
          "version": 1,
          "timeRestore": false,
          "kibanaSavedObjectMeta": {
            "searchSourceJSON": """{"id":"AWLOeppmLaWygeBEGxLI","filter":[{"meta":{"index":".watcher-*","type":"phrase","key":"state","value":"failed","disabled":false,"negate":false,"alias":null},"query":{"match":{"state":{"query":"failed","type":"phrase"}}},"$state":{"store":"appState"}},{"query":{"match_all":{}}}],"highlightAll":true,"version":true}"""
          }
        }
      }
    ]
  }
}

X-Pack Security

Next checkpoint is to look on the security or granted permissions. In the official docs they are using the superuser elastic. Not recommended.

The reporting user must have the roles

• reporting_user in order to execute report generation
• watcher_user in order to read the watch data
• kibana_user in order to access the Kibana objects

A quick check with Kibana Console:

GET /_xpack/security/user/reporting_wotscher

{
  "reporting_wotscher": {
    "username": "reporting_wotscher",
    "roles": [
      "monitoring_user",
      "reporting_user",
      "watcher_user"
    ],
    "full_name": "Elastic Wotscher",
    "email": "le-mapper@cinhtau.net",
    "metadata": {},
    "enabled": true
  }
}

kibana_user is missing. Without the permission he could not read the .kibana index and thus can’t find the dashboard object with the id.

Add the permission with Kibana Console.

PUT /_xpack/security/user/reporting_wotscher
{
    "username": "reporting_wotscher",
    "password: "guess-it",
    "roles": [
      "monitoring_user",
      "reporting_user",
      "watcher_user",
      "kibana_user"
    ],
    "full_name": "Elastic Wotscher",
    "email": "le-mapper@cinhtau.net",
    "metadata": {},
    "enabled": true  
}