How do I pass the value of my field in a dashboard's filter?

Hello everyone,
I'm struggling with this and I know this is possible (as I have seen someone doing it), but somehow I can't make it work for me :

I have a dashboard, which display the result of a Saved Search (saved from the discovery part).
I would like my user to be able to trigger a filter when they click on the value of one of the displayed field (which is a keyword text field). They click, it opens a new tab with the same dashboard, and the value they clicked on is passed as a value for a filter

What I've tried so far :
I have my dashboard, with some pinned filters, and a filter on the scripted field "Suivre Application".
I have made a Scripted field. Type String and link, format Url. The url template is like this (sorry, it's very long, as I have other pinned filters, i have highlitghted the important part) :

#/dashboard/b52c9b50-6807-11e9-a76c-57b197a9da76?_g=(refreshInterval:(pause:!t,value:0),time:(from:now-90d,mode:quick,to:now))&_a=(description:'',filters:!(('$state':(store:appState), meta:(alias:DEBUG,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76, key:severity,negate:!t,params:(query:DEBUG,type:phrase), type:phrase,value:DEBUG),query:(match:(severity:(query:DEBUG, type:phrase)))),('$state':(store:appState),meta:(alias:ERROR, disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:ERROR, type:phrase),type:phrase,value:ERROR),query:(match:(severity:(query:ERROR, type:phrase)))),('$state':(store:appState),meta:(alias:WARN,disabled:!t, index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:WARN, type:phrase),type:phrase,value:WARN),query:(match:(severity:(query:WARN,type:phrase)))), ('$state':(store:appState),meta:(alias:TRACE,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76, key:severity,negate:!t,params:(query:TRACE,type:phrase),type:phrase,value:TRACE), query:(match:(severity:(query:TRACE,type:phrase)))),('$state':(store:appState), meta:(alias:INFO,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76, key:severity,negate:!t,params:(query:INFO,type:phrase),type:phrase,value:INFO), query:(match:(severity:(query:INFO,type:phrase)))),('$state':(store:appState), meta:(alias:!n,disabled:!f,index:f22f8760-65c3-11e9-a76c-57b197a9da76, key:'Suivre+Application',negate:!f,params:(query:{{value}},type:phrase), type:phrase,value:{{value}}),query:(match:('Suivre+Application':(query:{{value}},type:phrase))))), fullScreenMode:!f,options:(darkTheme:!f,hidePanelTitles:!f,useMargins:!t), query:(language:lucene,query:''), timeRestore:!f, title:'Dashboard+Logs+Applicatifs_essai_liens', viewMode:view)

The link works, it opens a new tab with the corresponding dashboard, but the value of the filter "Suivre Application" doesn't change. It always have the value with which i've created it.

Then I tried to modify the field "applicative_code" from which this scripted field got his value.
I changed it to Format : Url and Type: Link. In the URL template, i've pasted the url of my dashboard, and modified the value of the filter with {{value}} :

http://mydomain.com/app/kibana#/dashboard/b52c9b50-6807-11e9-a76c-57b197a9da76?_g=(refreshInterval:(display:Off,pause:!t,value:0),time:(from:now-90d,mode:quick,to:now))&_a=(description:'',filters:!(('$state':(store:appState),meta:(alias:DEBUG,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:DEBUG,type:phrase),type:phrase,value:DEBUG),query:(match:(severity:(query:DEBUG,type:phrase)))),('$state':(store:appState),meta:(alias:ERROR,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:ERROR,type:phrase),type:phrase,value:ERROR),query:(match:(severity:(query:ERROR,type:phrase)))),('$state':(store:appState),meta:(alias:WARN,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:WARN,type:phrase),type:phrase,value:WARN),query:(match:(severity:(query:WARN,type:phrase)))),('$state':(store:appState),meta:(alias:TRACE,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:TRACE,type:phrase),type:phrase,value:TRACE),query:(match:(severity:(query:TRACE,type:phrase)))),('$state':(store:appState),meta:(alias:INFO,disabled:!t,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:severity,negate:!t,params:(query:INFO,type:phrase),type:phrase,value:INFO),query:(match:(severity:(query:INFO,type:phrase)))),('$state':(store:appState),meta:(alias:!n,disabled:!t,field:applicative_code.keyword,index:f22f8760-65c3-11e9-a76c-57b197a9da76,key:applicative_code.keyword,negate:!f,params:(value:{{value}}),type:phrase,value:{{value}}),script:(script:(inline:'boolean+compare(Supplier+s,+def+v)+%7Breturn+s.get()+%3D%3D+v;%7Dcompare(()+-%3E+%7B+doc%5B!'applicative_code.keyword!'%5D.value+%7D,+params.value);',lang:painless,params:(value:{{value}}))))),fullScreenMode:!f,options:(darkTheme:!f,hidePanelTitles:!f,useMargins:!t),panels:!((gridData:(h:3,i:'1',w:12,x:0,y:0),id:'83289b70-65c5-11e9-a76c-57b197a9da76',panelIndex:'1',type:visualization,version:'6.2.2'),(gridData:(h:4,i:'2',w:12,x:0,y:3),id:'4db67120-6808-11e9-a76c-57b197a9da76',panelIndex:'2',sort:!('Suivre+Application',desc),type:search,version:'6.2.2')),query:(language:lucene,query:''),timeRestore:!t,title:'Dashboard+Logs+Applicatifs_essai_liens',viewMode:view)

Same problem as before, it opens the right dashboard, but it doesn't apply the right value for the filter.

I think my explanation might be complex. Don't hesitate to ask me to edit. Thank you all !

@lobotomeh,

your approach looks about right. Hacking the URL is really fickle. That part of the query-string is RISON encoded, so you must make sure that the {{value}} that gets plugged in creates a valid string. (e.g. if you have spaces in your value, they must be escaped with %20

When you click the link, what is the URL that is produced (so after substitution of {{value}}? Is that a valid URL and is the value plugged in correctly?

Hello Thomas, thank you for your reply !

So my original {{value}} looks like this :
AFA@1221@1062-MY_APPLICATION_1@1.0.0.SIG

And the value I can find in the URL looks like this :
AFA%401221%401062-MY_APPLICATION_1%401.0.0.SIG

So I guess here there is a problem with the encoding ? is the "@" character allowed ?
I couldn't find any useful ressource about Rison encoding, do you know one ?

EDIT :
I've tried with a url with a simple string : "hello". It works like this. So I guess the special characters are messing with the url.

As a work around, i've tried passing the {{value}} in a lucene query instead. So it looks like this in the url :

http://myurl.com/with_a_lot_of_parameters,
query:(language:lucene,query:{{value}}),timeRestore:!t,title:'Dashboard',viewMode:view)

But it doesn't work either.
Any idea of a work around ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.