# Elasticsearch query dsl alert rule to discover search object

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615>\
**Category:** Elastic Search\
**Created:** [May 27, 2025, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615 "2025-05-27T21:01:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baba\_Kourouma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baba_kourouma/32/143377_2.png) [@Baba\_Kourouma](https://discuss.elastic.co/u/Baba_Kourouma)\
**Post date:** [May 27, 2025, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615/1 "2025-05-27T21:01:23Z")

</div>

If I created an alert rule using elasticsearch query dsl, how can I get the corresponding search object in Discover so that I can see the logs that triggered this alert?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [May 28, 2025, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615/2 "2025-05-28T09:07:54Z")

</div>

Hello @Baba_Kourouma

Welcome to the community.

Could you please share what is your exact requirement maybe with an example?

You have created an alert using elasticsearch query dsl , to search in discover you can check the query filter used as part of Alert.

Thanks!!

---

<div class="post-metadata">

**Author:** ![Baba\_Kourouma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baba_kourouma/32/143377_2.png) [@Baba\_Kourouma](https://discuss.elastic.co/u/Baba_Kourouma)\
**Post date:** [May 28, 2025, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615/3 "2025-05-28T13:01:10Z")

</div>

What I want is to be able to have a link in the action (a slack message) that would take me to discover with a view that is equivalent to the elasticsearch query dsl used in the alert rule.

Thank you!

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [May 29, 2025, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-alert-rule-to-discover-search-object/378615/4 "2025-05-29T05:27:13Z")

</div>

Thanks @Baba_Kourouma for the details.

Please review steps provided in below blog :

> [@How to include specific fields (columns) in Kibana Discover links in alert emails?](https://discuss.elastic.co/t/how-to-include-specific-fields-columns-in-kibana-discover-links-in-alert-emails/370958/4):
>
> Thank you for the information. The steps i was asking to follow is as below : Go to discover & apply all the filter,columns you want to see. Save this view will all filters/columns with a name ABC Now you clear all the filters & on discover we will see Open \> ABC On selecting ABC it should auto apply the filters & view will be shown. Now we have a URL which is formed for this specific view From the URL you get, it needs to be configured to below : [https://yourURL/app/discover#/view/yourview\_…](https://yourURL/app/discover#/view/yourview_id?_g=(filters%3A!()%2CrefreshInterval%3A(pause%3A!t%2Cvalue%3A0)%2Ctime%3A(from%3A'2024-11-25T10:39:31.310961588Z%7C%7C-24h'%2Cmode%3Aabsolute%2Cto%3A'2024-11-25T10:39:31.310961588Z'))

Thanks!!