Migrating Queries From Lens and Saved Objects -- Data Tangles To Data...

Migrating Queries From Lens and Saved Objects – Data Tangles To Data Order - Sarah Hudspeth & Jason Ng, Chronosphere Migrating between logging solutions is never easy—but moving off a proprietary Kibana instance turned into an unexpectedly complex adventure. We had to extract filters, queries, and navigate a maze of nested query JSONs in older versions of Kibana and OpenSearch—all without the benefit of backwards compatibility. In this talk, we’ll share the automation and tooling we developed to locate and convert the filters and queries buried in Lens and Visualization data objects. Our approach to wrangling KQL, DQL, and Lucene query languages and untangling complex data schemas. You’ll leave with a deeper understanding of how log data can be structured and restructured effectively. The session includes a demo of our tooling in action and broader recommendations on how to approach similar migrations from closed-source platforms. Whether you’re facing a migration or just want to understand more about the data powering Lens and Saved Objects, you’ll come away with a deeper grasp of what’s under the hood—and how to work with it on your own terms.