Alerting Rule with link to Discover

Elastic Stack Elasticsearch
1

Hi Guys,
I'm trying to get my head around the following:

Is it possible to have a Discover Link included in the E-Mail Alert?

The Use-Case is as following:
Whenever I receive an Alert over the Mail Connector, I'd like to have a Link in that E-Mail that leads me directly to Discover and displays all of the entries regarding this Alert.
I do believe something similar has existed? If this still does work, whats the Field name I have to place in the Alert-Mail?

Thanks for the help in Advance!

2

Hi @_Thomas,

Welcome to the community! I'm not aware of a way to add the link to the discover menu with parameters. Have you looked at the email attachment feature to see if sending a generated dashboard report as an attachment would work for you?

Let us know!

3

Hi @carly.richmond
Thanks for the swift reply.

I've had a quick glance at your Article - this however is sadly not what I'm looking for. I do believe in an older Version of Elasticsearch there was a possibility to add the Discover Link with the Timeframe from when the Alert triggered.

I might be wrong, though.

4

Thanks for confirming. I did find this old thread from 2016 that suggests having the link as metadata and then invoking the property in the email body.

Is that closer to what you need?

5

This looks more promising - appreciate that! :slight_smile:

Looking through the attached github Link - it seems that this is either a Feature Request or something you guys aren't supporting for long.

Do you happen to know, whether or not something like that will make it into a future (major/minor) release? I guess I'm probably not the only one, interested in that feature/function :sweat_smile:

6

Hi @_Thomas,

Do you mean the issue for adding documentation of the RISON format?

I see that issue has been closed due to inactivity, but there is a bit about interacting with that format here in the documentation and also in this forum post.

Hope that helps!

7

Hi,
yes that was the Link I was referring to.

I'll have a closer look into the Documentation as well as the other Link you've posted.

I appreciate the help on that one :slight_smile: