Access index id in scripted field

Elastic Stack Kibana
1

I'd like to create a scripted field URL, linking to the context of an event

The context links look like: #/context/982353c0-ac85-11e8-a1c9-1f53c4cb4ccc/doc/LS9okWUBoR_D7GtSWhbM?_a=(columns:!(docker.container.name,err.message,err.stack),filters:!(),predecessorCount:5,sort:!('@timestamp',desc),successorCount:5)&_g=(filters:!())

982353c0-ac85-11e8-a1c9-1f53c4cb4ccc is the current index id (I guess), I'd like to not hardcode it

I tried to do:

Link pattern:

#/context/{{rawValue}}?_a=(columns:!(docker.container.name,err.message,err.stack),filters:!(),predecessorCount:5,sort:!('@timestamp',desc),successorCount:5)&_g=(filters:!())

Script:

doc['_index'].value + '/doc/' + doc['_id'].value

This give links like: #/context/filebeat-6.4.0-2018.08.30/doc/LS9okWUBoR_D7GtSWhbM?_a... but they don't link correctly

So I need to figure what that 982353c0-ac85-11e8-a1c9-1f53c4cb4ccc is, and how it can be accessed

When I look at 2 elasticsearch indexes

      "provided_name": "filebeat-6.4.0-2018.08.30",
      "creation_date": "1535654788427",
      "number_of_replicas": "1",
      "uuid": "8mfJNvygSry5DqjCSo-fZQ",

      "provided_name": "filebeat-6.4.0-2018.08.31",
      "creation_date": "1535713413751",
      "number_of_replicas": "1",
      "uuid": "Css9QSqaQG62W3TEtL8yhQ",

Their uuids don't match that value

> Buffer.from('982353c0-ac85-11e8-a1c9-1f53c4cb4ccc'.replace(/-/g, ''), 'hex').toString('base64')
'mCNTwKyFEeihyR9TxMtMzA=='
2

Hello

I tried that script and got expected output
field - testfield
value - indexName-2018.08.31/doc/7e62f4ae5e9da12633c55581e46040721b61c408

can you check if you are getting uniq _id in each log?

3

Thanks, that script work indeed, but not the #/context/SOME_ID/doc/DOC_ID?.... link

SOME_ID isn't the index id as I thought

You can get those links from the discover tab:

2018-09-02-002129_1110x220_scrot
2018-09-02-002129_1110x220_scrot.png1152×256 46.7 KB

The question is really what is SOME_ID there? I'm going to hardcode it for now, but I feel it's bad

4

solved in What is the ID in documents or surrounding documents links?