The easiest way to figure out how to make that work is to load the dashboard in Kibana and copy the URL, then add a search and copy the URL again, then compare the two. You'll notice that the
query parameter in the URL changes.
Everything you see in the
a= assignment is something called "app state" in Kibana (any
g= values are "global state"). This is just a JSON representation of Kibana's state (global or app, accordingly), which in this case includes the
query, which is simply the raw Elasticsearch query, using RISON formatting to make it URL safe.
You'll need to write some JS code to update the URL of the iFrame in order to "inject" a query. So, your app would need to take a query, convert it into Elasticsearch query DSL, and then convert that JSON into RISON. There's a library on npm called rison-node that will make that last part pretty easy, it's the same library Kibana uses.
What you have here is close.
a=(filters:!(),query:(querystring:(analyze_wildcard:!t,query: "my query here"
That's not valid RISON, since you didn't close the object. Try this instead:
a=(filters:!(),query:(querystring:(analyze_wildcard:!t,query: "my query here")))
Here's some working code that takes the app state object and encodes it into RISON using