elastic / elastic/integrations

dashboards using string representation of searchSourceJSON, optionsJSON, and panelsJSON

Open
#19,224 5 comments 3 reactions 0 assignees View on GitHub
Team:Ecosystem Team:Integration-Experience Team:Obs-InfraObs Team:Security-Applied ML
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

Kibana dashboards can contain `searchSourceJSON`, `optionsJSON`, and `panelsJSON` as either parsed JSON objects or as stringified JSON. The string form appears when a dashboard author uses Kibana's "save assets" export instead of `elastic-package export`, which produces the object form.

A scan of `packages/*/kibana/dashboard/*.json` in elastic/integrations found **347 dashboards** across **105 packages** with at least one stringified field.

## Top affected packages

| Package | Dashboards |
|---|---|
| aws | 33 |
| network_traffic | 24 |
| azure_metrics | 14 |
| kubernetes | 13 |
| cloudflare_logpush | 13 |
| azure | 12 |
| gcp | 11 |
| apache_tomcat | 10 |
| amazon_security_lake | 10 |
| cloudflare | 8 |
| postgresql_otel | 7 |
| logstash | 7 |
| system | 6 |
| pad | 6 |
| cybereason | 6 |
| cisco_umbrella | 6 |
| aws_billing | 5 |

The remaining 88 packages each have 1–4 affected dashboards.

These can be detected with `rg -l '"(searchSourceJSON|optionsJSON|panelsJSON)"\s*:\s*"' packages/*/kibana/dashboard/*.json`.

The impact of this is primarily on reviewability of dashboards since the string renders on a single line and requires escaping, making the text harder to read. It also impacts on automated reviewing skills that we provide which depend on being able to parse the JSON in these objects. It has no impact on the actual functionality of the dashboard as this is the native exported form of the data; the object form is a product of `elastic-package`'s export function.

The fix is to re-export each of the affected dashboards with `elastic-package export` to convert stringified JSON to objects.

> [!NOTE]
> I've tried to label all the teams that are affected, but there do not appear to be team labels for all cases. The full set is:
> apm-agent-rum ecosystem ingest-otel-data integration-experience kibana-management logstash obs-ds-hosted-services obs-infraobs-integrations sec-applied-ml sec-linux-platform security-service-integrations sec-windows-platform sit-crest-contractors stack-monitoring

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.