Access Kibana config value from scripted field?

[dcode (Derek Ditch)]

I'm interested in programmatically creating a scripted field using Painless. Namely, I want to create a string type that is formatted as a URL. I can create the field without problem. I can also push the Kibana configuration via the create index-pattern API. However, I'd like to be able to template out the base URL into a Kibana config value. This way a user can just change the config value (or via a script) for their environment and not have to change the Painless script.

The only other option that I can think of is to template the index pattern on disk, render the template, and update the index pattern.

Thanks!

[jbudz (Jon Budzenski)]

You can use the url field formatter on top of a scripted field, is that sufficient? It takes a template:

From a painless script there's no way to access Kibana variables currently. The script is executed on elasticsearch and we aren't adding extras.

[dcode (Derek Ditch)]

I tried that, and it would be great, except the value field of the template escapes slashes needed for my URI build.

Right now I've got:

String baseUrl = 'https://192.168.1.2:8443/api/uri/';
if (doc['@meta.event_type'].value == 'network')
{ 
  String host1 = doc['@meta.orig_host'].value;
  String host2 = doc['@meta.resp_host'].value;
  String port1 = doc['@meta.orig_port'].value.toString();
  String port2 = doc['@meta.resp_port'].value.toString();
  String timestamp = doc['@timestamp'].getDate().toString();
  timestamp = timestamp.substring(0,timestamp.indexOf('Z'));
  String begin = timestamp.substring(0,timestamp.indexOf('.')) + 'Z';
  
  return baseUrl + 
              'host/' + host1 + '/port/' + port1 +
             '/host/' + host2 + '/port/' + port2 + 
             '/after/' + begin + '/';
}
return null;

The baseUrl is configurable at install time. So what I'll need to do is run a Jinja2 engine or something on the index-pattern json file before uploading it via the API. It'd be super helpful to expose the parameter feature of Painless scripts in Kibana. I'm concerned how well a template engine will do on a JSON file with a quoted JSON string embedded, that contains template escapes {{ }}

[jbudz (Jon Budzenski)]

Got you, and agreed. As a workaround does the current scripted field you have with the slashes and then using the url formatter on top work?

[dcode (Derek Ditch)]

No, I'm sorry but it doesn't because the value is URL encoded when passed into the URL template. I mean, sanitizing input is important, but it just doesn't work for the URL use case when you're trying to build a URI. As a workaround, I'll just template the index pattern offline and update when necessary.

If I want to make a feature requires for parameter support, do I do that via GitHub issues for kibana?