# Drilldown-url issue

**URL:** <https://discuss.elastic.co/t/drilldown-url-issue/381571>\
**Category:** Elastic Search\
**Created:** [September 3, 2025, 4:44pm UTC](https://discuss.elastic.co/t/drilldown-url-issue/381571 "2025-09-03T16:44:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leonardo\_Soto\_T](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leonardo_soto_t/32/144312_2.png) [@Leonardo\_Soto\_T](https://discuss.elastic.co/u/Leonardo_Soto_T)\
**Post date:** [September 3, 2025, 4:44pm UTC](https://discuss.elastic.co/t/drilldown-url-issue/381571/1 "2025-09-03T16:44:17Z")

</div>

Hello,

I'm working with Peoplesoft, Elasticsearch and Kibana. I have a native query that generates accounting entry information. When executed, all the information is shown correctly, including the drill-down URL. If I run tests to see how it will be exported to Elasticsearch, the resulting file also displays correctly including the drill-down URL. However, when it's transferred to Elastic, the drill-down URL is modified, changing the server and portal name to generic data. Does anyone know what needs to be configured within Peoplesoft so that Elasticsearch receives the correct information?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [September 4, 2025, 8:38am UTC](https://discuss.elastic.co/t/drilldown-url-issue/381571/2 "2025-09-04T08:38:27Z")

</div>

Hello @Leonardo_Soto_T

Welcome to the community!!

The URL formed is on the source (Peoplesoft) which is correct & while sending this to Elasticsearch, server/portal name are replaced with generic information. Is this understanding correct?

If yes, could you please share as to how the data is sent from Peoplesoft to Elasticsearch?  
If logstash/ingest pipeline is used in your current usecase?

Thanks!!

---

<div class="post-metadata">

**Author:** ![Leonardo\_Soto\_T](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leonardo_soto_t/32/144312_2.png) [@Leonardo\_Soto\_T](https://discuss.elastic.co/u/Leonardo_Soto_T)\
**Post date:** [September 4, 2025, 5:05pm UTC](https://discuss.elastic.co/t/drilldown-url-issue/381571/3 "2025-09-04T17:05:09Z")

</div>

Hi:

Yes the url is formed on Peoplesoft, and it is sent through integration broker to logstash, somehow during this step url is modified.  
I believe that it is peoplesoft the one changing it but when we check the query or the Search definition preview we get the correct url.

Example:

What we see at Query level and in Search Definition data preview:

http:/ /150.53.112.105:31270/psc/fs92dev\_newwin/EMPLOYEE/ERP/c/PROCESS\_JOURNALS.JOURNAL\_ENTRY\_IE.GBL?Action=U&BUSINESS\_UNIT=XXXXX&JOURNAL\_ID=0000638&JOURNAL\_DATE=2024-06-15&UNPOST\_SEQ=0

Vs what arrives to Elastic:

http:// myserver/psc/ps\_newwin/EMPLOYEE/ERP/c/PROCESS\_JOURNALS.JOURNAL\_ENTRY\_IE.GBL?Action=U&BUSINESS\_UNIT=XXXXX&JOURNAL\_ID=0000638&JOURNAL\_DATE=2024-06-15&UNPOST\_SEQ=0

The url on Peoplesoft side is assembled dynamically so I think we are missing one configuration.

I was wondering if someone had this same issue at some point.