Alerting Rule with link to Discover

_Thomas · June 18, 2024, 8:25am

Hi Guys,
I'm trying to get my head around the following:

Is it possible to have a Discover Link included in the E-Mail Alert?

The Use-Case is as following:
Whenever I receive an Alert over the Mail Connector, I'd like to have a Link in that E-Mail that leads me directly to Discover and displays all of the entries regarding this Alert.
I do believe something similar has existed? If this still does work, whats the Field name I have to place in the Alert-Mail?

Thanks for the help in Advance!

carly.richmond · June 18, 2024, 8:40am

Hi @_Thomas,

Welcome to the community! I'm not aware of a way to add the link to the discover menu with parameters. Have you looked at the email attachment feature to see if sending a generated dashboard report as an attachment would work for you?

Let us know!

_Thomas · June 18, 2024, 8:44am

Hi @carly.richmond
Thanks for the swift reply.

I've had a quick glance at your Article - this however is sadly not what I'm looking for. I do believe in an older Version of Elasticsearch there was a possibility to add the Discover Link with the Timeframe from when the Alert triggered.

I might be wrong, though.

carly.richmond · June 18, 2024, 8:46am

Thanks for confirming. I did find this old thread from 2016 that suggests having the link as metadata and then invoking the property in the email body.

Is that closer to what you need?

_Thomas · June 18, 2024, 8:52am

This looks more promising - appreciate that!

Looking through the attached github Link - it seems that this is either a Feature Request or something you guys aren't supporting for long.

Do you happen to know, whether or not something like that will make it into a future (major/minor) release? I guess I'm probably not the only one, interested in that feature/function

carly.richmond · June 18, 2024, 10:56am

Hi @_Thomas,

Do you mean the issue for adding documentation of the RISON format?

github.com/elastic/kibana

Document URL Parameters

opened 01:54PM - 26 Jun 15 UTC

closed 03:11PM - 08 Aug 22 UTC

justenwalker

Team:Docs stalled loe:small impact:low Feature:StateManagement

The format of the URL parameters is [RISON](https://github.com/Nanonid/rison), b…ut there is no documentation around the structure of this object. It doesn't appear to be a raw ES query object converted from JSON to RISON. Aside from reverse-engineering by reading the source code - there should be some documentation about the structure of the objects passed so that URLs can be easily generated by external systems. ## Example use-case 1. ELK is aggregating log information to a central place. 2. An error occurs on an application server. 3. An email is sent with the corresponding Kibana Discover URL which narrows down the time-frame and applies some filters. 4. An engineer clicks on the URL and is able to quickly get the log information they need to debug issue.

I see that issue has been closed due to inactivity, but there is a bit about interacting with that format here in the documentation and also in this forum post.

Hope that helps!

_Thomas · June 18, 2024, 11:11am

Hi,
yes that was the Link I was referring to.

I'll have a closer look into the Documentation as well as the other Link you've posted.

I appreciate the help on that one