How to create a dynamic url for kibana discover

[rockyadi]

Hi we have a daily report we publish in which we would like to provide a dynamic link (URL) to kibana with a dynamic search term string query say "Error Fetching, Shipping Details" and in a particular dynamic time frame say "from:10/18/2019 to 10/17/2019" on a particular search index "app-metric-*"

followed this answer Generating a url that contains a query

the answer is not an exact match to our requirement as the answer has key: params: style where as mine is a simple string query and time in the answer is now -24h where as we would like it to be particular dates with time say from 10/18/2019:6:00 to 10/17/209:6:0:0

and tried to create a url like this,

http://localhost:5601/app/kibana#/discover?_g=(refreshInterval:(pause:!t,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),filters:!(('$state':(store:appState),meta:(alias:!n,disabled:!f,index:app-metric-events-,negate:!f,params:(query:"Error Fetching Shipping ,Details",type:phrase),type:phrase,value:"Error Fetching, Shipping Details"),query:(match:(query:"Error Fetching, Shipping Details",type:phrase)))),index:app-metric-events-,interval:auto,query:(language:lucene,query:''),sort:!(timestamp,desc))

when i paste in the browser it is redirecting to kibana site (No search term is populated, index is not populated, timeframe is not populated) but on the site we are getting "url parse exception" model but it's not specific to which part failed, we are fairly new to kibana appreciate the community help in resolving the issue please.

Thanks

[matw (Matthias Wilhelm)]

Hi & Welcome to the Kibana community!

So here's a similar query I did in Discover

http://localhost:5601/app/kibana#/discover?_g=(refreshInterval:(pause:!t,value:0),time:(from:'2019-10-16T06:00',to:'2019-10-18T06:00'))&_a=(columns:!(_source),index:'logstash-*',interval:auto,query:(language:lucene,query:'Error%20Fetching,%20Shipping%20Details'),sort:!(!('@timestamp',desc)))

you could adapt it for your use case, replace from and to ( (formatted like in the example)), index, and in query replace/encode spaces with %20

Then it should work

[rockyadi]

Thank you very much @matw you are a life saver!

[rockyadi]

@matw the solution you shared seem to work for all the fields where it is populating the search term and time filter but it's not populating the index 'logstash-' **getting the error 'logstash-' is not a default index** "even though an index by the name logstash-* exists any thoughts on it will be of great help

[matw (Matthias Wilhelm)]

@matw

,index:'logstash-*'

When you're manually using Discover, and you select 'logstash-' as index pattern, take a look at the url of you browser, check what's set in following part ,index:'logstash-'. Normally when you add a index pattern manually, a UUID is generated as id, and that's the ID you should use. Hope this helps

[rockyadi]

@matw tried it but looks the id is changing dynamically for example i had kibana#/discover?_g=h@44136fa&_a=h@d58c75e but a colleague had kibana#/discover?_g=h@44136fa&_a=h@8e6425b when adding the index, i feel we are close but jus need to get the index part sorted out and appreciate the community's help in overcoming this issue