Dashboard search parameter via URL

Elastic Stack Kibana
1

Greetings,

I am loading a dashboard via an iFrame using the 'Share saved dashboard'. How can I pass a search parameter in via the URL? I can see how to do this using a 'Share Snapshot' though is this possible with the share saved too?

I tried the following:
app/kibana#/dashboard/871da8e0-2906-11e7-8b6d-691e5dcfa99e?embed=true&_g=(refreshInterval%3A(display%3AOff%2Cpause%3A!f%2Cvalue%3A0)%2Ctime%3A(from%3Anow-24h%2Cmode%3Aquick%2Cto%3Anow))&a=(filters:!(),query:(query_string:(analyze_wildcard:!t,query: "my query here"

Thank you for your help.

Regards,

James

2

The easiest way to figure out how to make that work is to load the dashboard in Kibana and copy the URL, then add a search and copy the URL again, then compare the two. You'll notice that the query parameter in the URL changes.

Everything you see in the a= assignment is something called "app state" in Kibana (any g= values are "global state"). This is just a JSON representation of Kibana's state (global or app, accordingly), which in this case includes the query, which is simply the raw Elasticsearch query, using RISON formatting to make it URL safe.

You'll need to write some JS code to update the URL of the iFrame in order to "inject" a query. So, your app would need to take a query, convert it into Elasticsearch query DSL, and then convert that JSON into RISON. There's a library on npm called rison-node that will make that last part pretty easy, it's the same library Kibana uses.

What you have here is close.

a=(filters:!(),query:(querystring:(analyze_wildcard:!t,query: "my query here"

That's not valid RISON, since you didn't close the object. Try this instead:

a=(filters:!(),query:(querystring:(analyze_wildcard:!t,query: "my query here")))

Here's some working code that takes the app state object and encodes it into RISON using rison-node: http://requirebin.com/?gist=9aed0aa9a3d33505317cc18b03abbe2e

5 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.