[BEAT] Winlogbeat in 8.9.2 / multiple Spaces / Dashboard same in Winlogbeat 8.10.0-8.10.1

[cemetery84]

          > The fix is merged and will be included in 8.9.2

Now Logs and metrics Data View are fixed but winlogbeat (Data View) has now the problem

Originally posted by @cemetery84 in elastic/kibana#164243 (comment)

[cemetery84]

If you import the Winlogbeat Dashboards to space.id xxx and restart Kibana the Data view missing in the custom space only the default Space has winlogbeat-* Data view with no Relationships

[cemetery84]

Exiting: error importing Kibana dashboards: fail to import the dashboards in Kibana: Error importing directory C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana: Failed to import dashboard: Failed to load directory C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana/7:
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\01c54730-fee6-11e9-8405-516218e3d268.json: error dashboard asset: returned 200 to import file: 2 errors: error: conflict, asset ID=7e178c80-fee1-11e9-8405-516218e3d268; asset type=search; references=[]; error: conflict, asset ID=9066d5b0-fef2-11e9-8405-516218e3d268; asset type=search; references=[]. Response: {"successCount":20,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"6f0f2ea0-f414-11e9-8405-516218e3d268","meta":{"title":"Group Management Events - Description [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"98884120-f49d-11e9-8405-516218e3d268","meta":{"title":"Groups Created - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"9e534190-f49d-11e9-8405-516218e3d268","meta":{"title":"Group Changes - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"bb9cf7a0-f49d-11e9-8405-516218e3d268","meta":{"title":"Groups Deleted - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"ce867840-f49e-11e9-8405-516218e3d268","meta":{"title":"Users Added - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"fee83900-f49f-11e9-8405-516218e3d268","meta":{"title":"Users Removed from Group - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"bc165210-f4b8-11e9-8405-516218e3d268","meta":{"title":"Group Enumeration - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"a13bf640-fee8-11e9-8405-516218e3d268","meta":{"title":"Users Added - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"5eeaafd0-fee7-11e9-8405-516218e3d268","meta":{"title":"Groups Deleted- Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"f42f3b20-fee6-11e9-8405-516218e3d268","meta":{"title":"Groups Created - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"b5f38780-fee6-11e9-8405-516218e3d268","meta":{"title":"Groups Changes - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"1b5f17d0-feea-11e9-8405-516218e3d268","meta":{"title":"Users Removed from Group - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"0f2f5280-feeb-11e9-8405-516218e3d268","meta":{"title":"Group Membership Enumeration - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"d770b040-9b35-11ea-87e4-49f31ec44891","meta":{"title":"Dashboard links - Simple [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"33462600-9b47-11ea-87e4-49f31ec44891","meta":{"title":"Group Management Events - Event Actions - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"58fb9480-9b46-11ea-87e4-49f31ec44891","meta":{"title":"Group Management Events - Target Groups - Tag Cloud [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"e20c02d0-9b48-11ea-87e4-49f31ec44891","meta":{"title":"Group Management Events - Groups vs Actions - Heatmap [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"7de2e3f0-9b4d-11ea-87e4-49f31ec44891","meta":{"title":"Group Management Action Distribution over Time [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"b89b0c90-9b41-11ea-87e4-49f31ec44891","meta":{"title":"Group Management Events - Event Actions [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"dashboard","id":"01c54730-fee6-11e9-8405-516218e3d268","meta":{"title":"[Winlogbeat Security] Group Management Events - Simple Metrics","icon":"dashboardApp"},"managed":false,"overwrite":true}],"errors":[{"id":"7e178c80-fee1-11e9-8405-516218e3d268","type":"search","meta":{"title":"Logon Details [Winlogbeat Security]","icon":"discoverApp"},"error":{"type":"conflict"}},{"id":"9066d5b0-fef2-11e9-8405-516218e3d268","type":"search","meta":{"title":"Group Management Details - Search View [Winlogbeat Security]","icon":"discoverApp"},"error":{"type":"conflict"}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\035846a0-a249-11e9-a422-d144027429da.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=21aadac0-9c0b-11ea-87e4-49f31ec44891; asset type=visualization; references=[{Type:search ID:7e178c80-fee1-11e9-8405-516218e3d268}]. Response: {"successCount":12,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"804dd400-a248-11e9-a422-d144027429da","meta":{"title":"Logged on Administrators [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"5bb93ed0-a249-11e9-a422-d144027429da","meta":{"title":"Admin Logons Simple [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"e2516c10-a249-11e9-a422-d144027429da","meta":{"title":"Administrator Users [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"18348f30-a24d-11e9-a422-d144027429da","meta":{"title":"User Logon Dashboard [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"search","id":"ce71c9a0-a25e-11e9-a422-d144027429da","meta":{"title":"User Logons [Winlogbeat Security]","icon":"discoverApp"},"managed":false},{"type":"visualization","id":"2c71e0f0-9c0d-11ea-87e4-49f31ec44891","meta":{"title":"Logons Simple [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"abd44840-9c0f-11ea-87e4-49f31ec44891","meta":{"title":"Logon Events in Time - Simple [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"006d75f0-9c03-11ea-87e4-49f31ec44891","meta":{"title":"Logon Types [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"search","id":"6f4071a0-7a78-11ea-bc9a-0baf2ca323a3","meta":{"title":"Remote Interactive Connections and Disconnections [Winlogbeat Security]","icon":"discoverApp"},"managed":false},{"type":"visualization","id":"25f31ee0-9c23-11ea-87e4-49f31ec44891","meta":{"title":"Logon with Explicit Credentials [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"search","id":"06b6b060-7a80-11ea-bc9a-0baf2ca323a3","meta":{"title":"User Logouts [Winlogbeat Security]","icon":"discoverApp"},"managed":false},{"type":"dashboard","id":"035846a0-a249-11e9-a422-d144027429da","meta":{"title":"[Winlogbeat Security] User Logons - Simple Metrics","icon":"dashboardApp"},"managed":false}],"errors":[{"id":"21aadac0-9c0b-11ea-87e4-49f31ec44891","type":"visualization","meta":{"title":"Logon Sources [Winlogbeat Security]","icon":"visualizeApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"7e178c80-fee1-11e9-8405-516218e3d268"}]}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\71f720f0-ff18-11e9-8405-516218e3d268.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=71f720f0-ff18-11e9-8405-516218e3d268; asset type=dashboard; references=[{Type:search ID:7e178c80-fee1-11e9-8405-516218e3d268}]. Response: {"successCount":26,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"2dc6b820-b9e8-11e9-b6a2-c9b4015c4baf","meta":{"title":"User Management Events - Description [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"5e7f0ed0-bcd2-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Created - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"0620c3d0-bcd4-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Enabled - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"8f20c950-bcd4-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Disabled - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"ee0319a0-bcd4-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Deleted - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"da5ffe40-bcd9-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Password Changes - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"da2110c0-bcea-11e9-b6a2-c9b4015c4baf","meta":{"title":"Unlocked Users - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"abf96c10-bcea-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Changes Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"4ac8f5f0-bcfe-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Locked Out - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"search","id":"324686c0-fefb-11e9-8405-516218e3d268","meta":{"title":"User management Details - Search [Winlogbeat Security]","icon":"discoverApp"},"managed":false},{"type":"visualization","id":"97c70300-ff1c-11e9-8405-516218e3d268","meta":{"title":"Users Disabled - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"bf45dc50-ff1a-11e9-8405-516218e3d268","meta":{"title":"Users Enabled - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"7322f9f0-ff1c-11e9-8405-516218e3d268","meta":{"title":"Users Deleted - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"d3a5fec0-ff18-11e9-8405-516218e3d268","meta":{"title":"Users Created - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"1b6725f0-ff1d-11e9-8405-516218e3d268","meta":{"title":"Users Unlocks - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"60301890-ff1d-11e9-8405-516218e3d268","meta":{"title":"Users Password Changes - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"9dd22440-ff1d-11e9-8405-516218e3d268","meta":{"title":"Users locked Out - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"c9d959f0-ff1d-11e9-8405-516218e3d268","meta":{"title":"Users Changes TS VB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"1f271bc0-231a-11ea-8405-516218e3d268","meta":{"title":"Users Renamed TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"fa876300-231a-11ea-8405-516218e3d268","meta":{"title":"Users Renamed - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"a3c3f350-9b6d-11ea-87e4-49f31ec44891","meta":{"title":"Dashboard links [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"26877510-9b72-11ea-87e4-49f31ec44891","meta":{"title":"User Management Actions [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"117f5a30-9b71-11ea-87e4-49f31ec44891","meta":{"title":"Target Users [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"5c9ee410-9b74-11ea-87e4-49f31ec44891","meta":{"title":"User Event Actions - Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"aa31c9d0-9b75-11ea-87e4-49f31ec44891","meta":{"title":"User Management Events - Affected Users vs Actions - Heatmap [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"caf4d2b0-9b76-11ea-87e4-49f31ec44891","meta":{"title":"Event Distribution in time [Winlogbeat Security]","icon":"visualizeApp"},"managed":false}],"errors":[{"id":"71f720f0-ff18-11e9-8405-516218e3d268","type":"dashboard","meta":{"title":"[Winlogbeat Security] User Management Events","icon":"dashboardApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"7e178c80-fee1-11e9-8405-516218e3d268"}]}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\8223bed0-b9e9-11e9-b6a2-c9b4015c4baf.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=8223bed0-b9e9-11e9-b6a2-c9b4015c4baf; asset type=dashboard; references=[{Type:search ID:7e178c80-fee1-11e9-8405-516218e3d268} {Type:search ID:324686c0-fefb-11e9-8405-516218e3d268}]. Response: {"successCount":9,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"102efd20-bcdd-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Created - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"855957d0-bcdd-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Enabled - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"c359b020-bcdd-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Deleted - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"0cb2d940-bcde-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Disabled - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"568a8130-bcde-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Password Reset / Changes [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"84502430-bce8-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Unlocks - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"ab6f8d80-bce8-11e9-b6a2-c9b4015c4baf","meta":{"title":"Unlocked Users - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"5d92b100-bce8-11e9-b6a2-c9b4015c4baf","meta":{"title":"Users Changes - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"5e19ff80-231c-11ea-8405-516218e3d268","meta":{"title":"Users Renamed - Simple Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false}],"errors":[{"id":"8223bed0-b9e9-11e9-b6a2-c9b4015c4baf","type":"dashboard","meta":{"title":"[Winlogbeat Security] User Management Events - Simple Metric","icon":"dashboardApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"7e178c80-fee1-11e9-8405-516218e3d268"},{"type":"search","id":"324686c0-fefb-11e9-8405-516218e3d268"}]}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\bae11b00-9bfc-11ea-87e4-49f31ec44891.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=bae11b00-9bfc-11ea-87e4-49f31ec44891; asset type=dashboard; references=[{Type:search ID:ce71c9a0-a25e-11e9-a422-d144027429da} {Type:search ID:6f4071a0-7a78-11ea-bc9a-0baf2ca323a3} {Type:search ID:06b6b060-7a80-11ea-bc9a-0baf2ca323a3}]. Response: {"successCount":3,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"0622da40-9bfd-11ea-87e4-49f31ec44891","meta":{"title":"Administrator Logons [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"860706a0-9bfd-11ea-87e4-49f31ec44891","meta":{"title":"User Logons [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"a909b930-685f-11ea-896f-0d70f7ec3956","meta":{"title":"Logon Events Timeline [Winlogbeat Security]","icon":"visualizeApp"},"managed":false}],"errors":[{"id":"bae11b00-9bfc-11ea-87e4-49f31ec44891","type":"dashboard","meta":{"title":"[Winlogbeat Security] User Logons","icon":"dashboardApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"ce71c9a0-a25e-11e9-a422-d144027429da"},{"type":"search","id":"6f4071a0-7a78-11ea-bc9a-0baf2ca323a3"},{"type":"search","id":"06b6b060-7a80-11ea-bc9a-0baf2ca323a3"}]}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\bb858830-f412-11e9-8405-516218e3d268.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=bb858830-f412-11e9-8405-516218e3d268; asset type=dashboard; references=[{Type:search ID:7e178c80-fee1-11e9-8405-516218e3d268} {Type:search ID:9066d5b0-fef2-11e9-8405-516218e3d268}]. Response: {"successCount":6,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"ffebe440-f419-11e9-8405-516218e3d268","meta":{"title":"Users Added - Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"e22c6f40-f498-11e9-8405-516218e3d268","meta":{"title":"Groups Deleted TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"ee292bc0-f499-11e9-8405-516218e3d268","meta":{"title":"Groups Created TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"400b63e0-f49a-11e9-8405-516218e3d268","meta":{"title":"Groups Changed TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"a5f664c0-f49a-11e9-8405-516218e3d268","meta":{"title":"Users Removed - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"546febc0-f49b-11e9-8405-516218e3d268","meta":{"title":"Groups Enumeration - TSVB Metric [Winlogbeat Security]","icon":"visualizeApp"},"managed":false}],"errors":[{"id":"bb858830-f412-11e9-8405-516218e3d268","type":"dashboard","meta":{"title":"[Winlogbeat Security] Group Management Events","icon":"dashboardApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"7e178c80-fee1-11e9-8405-516218e3d268"},{"type":"search","id":"9066d5b0-fef2-11e9-8405-516218e3d268"}]}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\c77e06c0-9e7c-11ea-af6f-cfdb1ee1d6c8.json: error dashboard asset: returned 200 to import file: 1 error: error: conflict, asset ID=11a61760-9f27-11ea-bef1-95118e62a7c1; asset type=search; references=[]. Response: {"successCount":18,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"9ec52c30-9e91-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Connected users [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"52543ef0-9e95-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Total engine started [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"7f3e7710-9e94-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Total commands [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"78874900-9f30-11ea-bef1-95118e62a7c1","meta":{"title":"Total remote commands [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"e64ff750-9f28-11ea-bef1-95118e62a7c1","meta":{"title":"Unique users [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"2dbabdf0-9f29-11ea-bef1-95118e62a7c1","meta":{"title":"Unique engine versions [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"92a2a6b0-9f29-11ea-bef1-95118e62a7c1","meta":{"title":"Unique hosts [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"e20b3940-9e9a-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Engine versions ran by host [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"1eeaaf70-9f23-11ea-bef1-95118e62a7c1","meta":{"title":"Engine versions [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"f9fa55f0-9f34-11ea-bef1-95118e62a7c1","meta":{"title":"Host processes [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"3e55daa0-9e8e-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Users [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"d27dea70-9f32-11ea-bef1-95118e62a7c1","meta":{"title":"Event type [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"fbb025e0-9e7c-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Event Levels [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"7adbce50-9e96-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Engine and Command started[Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"70751050-9f33-11ea-bef1-95118e62a7c1","meta":{"title":"Top active hosts [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"b0c5d570-9e7c-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Top Invoked Commands [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"c0945210-9e8b-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"Started providers [Winlogbeat powershell]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"dashboard","id":"c77e06c0-9e7c-11ea-af6f-cfdb1ee1d6c8","meta":{"title":"[Winlogbeat powershell] Overview","icon":"dashboardApp"},"managed":false,"overwrite":true}],"errors":[{"id":"11a61760-9f27-11ea-bef1-95118e62a7c1","type":"search","meta":{"title":"Details [Winlogbeat powershell]","icon":"discoverApp"},"error":{"type":"conflict"}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\d401ef40-a7d5-11e9-a422-d144027429da.json: error dashboard asset: returned 200 to import file: 1 error: error: conflict, asset ID=757510b0-a87f-11e9-a422-d144027429da; asset type=search; references=[]. Response: {"successCount":11,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"c2ea73f0-a4bd-11e9-a422-d144027429da","meta":{"title":"Failed Logon and Account Lockout [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"175a5760-a7d5-11e9-a422-d144027429da","meta":{"title":"Logon Successful vs Failed [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"7a329a00-a7d5-11e9-a422-d144027429da","meta":{"title":"Blocked Accounts Tag [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"162d7ab0-a7d6-11e9-a422-d144027429da","meta":{"title":"Logon Successful - Logon Failed Timeline [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"729443b0-a7d6-11e9-a422-d144027429da","meta":{"title":"Logon Failed Acconts [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"4b683ac0-a7d7-11e9-a422-d144027429da","meta":{"title":"Failed Logon HeatMap [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"2084e300-a884-11e9-a422-d144027429da","meta":{"title":"Logon Failed Source IP [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"421f0610-af98-11e9-a422-d144027429da","meta":{"title":"Logon Failed Table [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"8ef59f90-6ab8-11ea-896f-0d70f7ec3956","meta":{"title":"Failed Logons TSVB [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"visualization","id":"a79395f0-6aba-11ea-896f-0d70f7ec3956","meta":{"title":"Blocked Accounts TSVB [Winlogbeat Security]","icon":"visualizeApp"},"managed":false,"overwrite":true},{"type":"dashboard","id":"d401ef40-a7d5-11e9-a422-d144027429da","meta":{"title":"[Winlogbeat Security] Failed and Blocked Accounts","icon":"dashboardApp"},"managed":false,"overwrite":true}],"errors":[{"id":"757510b0-a87f-11e9-a422-d144027429da","type":"search","meta":{"title":"3. Login Failed Details","icon":"discoverApp"},"error":{"type":"conflict"}}]}
error loading C:\Users\importuser\Desktop\winlogbeat-8.9.2-windows-x86_64\kibana\7\dashboard\f49f3170-9ffc-11ea-87e4-49f31ec44891.json: error dashboard asset: returned 200 to import file: 1 error: error: missing_references, asset ID=f49f3170-9ffc-11ea-87e4-49f31ec44891; asset type=dashboard; references=[{Type:search ID:757510b0-a87f-11e9-a422-d144027429da}]. Response: {"successCount":2,"success":false,"warnings":[],"successResults":[{"type":"visualization","id":"5d117970-9ffd-11ea-87e4-49f31ec44891","meta":{"title":"Blocked Accounts [Winlogbeat Security]","icon":"visualizeApp"},"managed":false},{"type":"visualization","id":"4bedf650-9ffd-11ea-87e4-49f31ec44891","meta":{"title":" Failed Logons [Winlogbeat Security]","icon":"visualizeApp"},"managed":false}],"errors":[{"id":"f49f3170-9ffc-11ea-87e4-49f31ec44891","type":"dashboard","meta":{"title":"[Winlogbeat Security] Failed and Blocked Accounts - Simple Metrics","icon":"dashboardApp"},"error":{"type":"missing_references","references":[{"type":"search","id":"757510b0-a87f-11e9-a422-d144027429da"}]}}]}

[cemetery84]

If you remove all Winlogbeat-Saved Objects in the custom Space and import the Dashboard to the default Space without the Setting space.id ... in the winlogbeat.yml it succeeds

[cemetery84]

all Relationships (76) after Restart Kibana

the second Data View with

[elasticmachine]

Pinging @elastic/integrations (Team:Beats)

[cemetery84]

Same problem in Version 8.10.0

[cemetery84]

Any feedback?

[cemetery84]

Same in Winlogbeat 8.10.1 why we get no help? What do you need? More Logs? Problem comes with the 8.9.2 Update...

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[juliaElastic]

Sorry, the issue was not labeled correctly, it should appear now in Fleet team's queue.

[cemetery84]

Same in Winlogbeat 8.11.0

[juliaElastic]

I had a look, and it seems the issue there is that winlogbeat has visualizations with kibana 7 version, e.g. here, so when imported to kibana 8+, the SO migration removes the space.
So to fix this, the visualizations have to be updated to kibana 8.x migration version.
Transferring this issue to elastic/beats repo to @elastic/elastic-agent team.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[pierrehilbert]

@andrewkroh would you mind to have a look here please?

[andrewkroh]

PR: #37085