How to include special characters in modified index pattern string. When using URL Format and 'value' label template

[Apollyon]

Hello,

On kibana and when editing the values on an Index Pattern, e.g. from the default 'string' to URL. When modifying the URL template to include a value, e.g. an email address, is there a way to take in this value to ignore special characters? As this works with just text/ numerical values like names and IP's.

'@ : ; '

As an example:

Below is the URL Template

http://localhost:5601/app/kibana#/discover?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-3d,to:now))&_a=(columns:!(_source),index:'An%20indexname',interval:auto,query:(language:kuery,query:'email:{{value}}'),sort:!(!('@timestamp',desc)))

Below is the Label Template

{{value}}

As can see with the modified link to include the value, when taking in the value an error keeps appearing about being unable to load the data due to ..

'KQLSyntaxError': Expected AND, OR, end of input, whitespace but "@" found .....

So is there a way to be able to allow it or get it to ignore this and to be able to take it in as normal valued data?

Thank you!

[nickpeihl]

Try using {{rawValue}} instead of {{value}} in the URL template.

[Apollyon]

hey @nickpeihl
thank you for the above!

I gave this a try with using {{rawValue}} but it is now not showing up with anything.
But when using the {{value}} the data is displayed again but coming up with the drill-down, it displays the same error.

Have been thinking about and using "Scripted Fields", so may give that a go .

Also, looking at this post about hyperlinking?

[nickpeihl]

Sorry, I am unable to reproduce the issue. What version of Kibana are you on?

My url template looks like this.
http://localhost:5601/app/kibana#/discover?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-3d,to:now))&_a=(columns:!(_source),index:'An%20indexname',interval:auto,query:(language:kuery,query:'email:{{rawValue}}'),sort:!(!('@timestamp',desc)))

The link works as expected.

[Apollyon]

Hey @nickpeihl,
Apologies for the response!
Thank you for your help on this!

I am on Kibana 7.4.1.

When I try using {{rawValue}} the fields become blank still.

Would the fact, i've just thought, that when this data is collected it is collected in '' so an email address will be displayed as 'email@email.com'. Would this have an effect?

[nickpeihl]

Ah, I think this is a bug. I was trying on 7.4.0. But now I see this bugfix that went into 7.4.2. Can you upgrade to 7.4.2 and see if the issue remains?

[Apollyon]

Ahh I see!

I have just upgraded to 7.4.2 and it is still showing the same issue with using {{rawValue}} within the link.

The bug still remains!

[nickpeihl]

Can you provide a example of a document that fails? Without a reproducible example I can not determine if this is a bug and how to fix it.

[Apollyon]

Hey @nickpeihl,
Thank you again for the tried help with this!

Below is maybe a better breakdown of an example.

Index field value pattern = "Recipients.keyword"
The normal data displayed in the field is an email as shown = 'jon.doe@email.com'

When creating a visualization, and using the "Recipients.keyword" term, the field is not displayed but when put with a secondary field e.g. count, the count is displayed along to the blank field. (Screenshots - data-for-vis.PNG / rawvalue.PNG)

Index term pattern set up

Format = Url
Type = Link
Open new tab = ticked (Yes)

Link used for the URL Template -

http://localhost:5601/app/kibana#/discover?_g=(refreshInterval:(pause:!t,value:0),time:(from:now-30m,to:now))&_a=(columns:!(_source),index:'8d78acd0-021b-11ea-ac2a-03fa520b5739',interval:auto,query:(language:kuery,query:'Recipients.keyword:{{rawValue}}'),sort:!(!('@timestamp',desc)))

Label Template - (rawvalue-indexfield.PNG)

{{rawValue}}

---

When preforming the same as above with the Label Template - (value-indexfield.PNG)

{{value}}

The email is displayed in the intended visualization.

But when going to drill down on the address, when on the search page, the an error is displayed. About "KQLSyntaxError"