#!/bin/bash

api_key="[ api_key ]"
kibana_endpoint="[ endpoint_url ]"

curl -s -X GET "$kibana_endpoint/api/saved_objects/_find?type=index-pattern&per_page=10000" \
  -H "Authorization: $api_key" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" |
jq -r '
  .saved_objects[]
  | select(.attributes.fields != null)
  | . as $dv
  | (.attributes.fields | fromjson? // [])
  | map(select(.scripted == true))
  | .[]?
  | "data_view=\($dv.attributes.title) field=\(.name) script=\(.script)"
'