How to link to entries triggering a rule

Elastic Stack Kibana
,
1

We have setup some Rules and Alerts that should trigger if we get error in our logs. In the mail that is sent when a rule is triggered it feels natural to include a link to Discover view with some filters setup and with the time interval that shows the error(s) that triggered the Rule+Alert.

We wonder if we're doing something fundamentally wrong because when adding some filters, the url to Discover view get so long that it sometimes exceed some limit that Outlook can handle.

Is it possible somehow to create a link to a Discover with some predefined filters that get a static, much shorter url that can be reused. The only thing we really want to vary is the time interval where we want to show only the interval where the errors appeared in our logs.

2

You can create a permalink using the Share link in Discover. From there you can select to use a short url. Here is the relevant documentation.

3

But can you generate a permalink through API or something since I need to create the link including the time interval containing the entries that triggered the rule. Not sure how that would be done. Haven't found anything about that in the documentation.

4

Yeah, that might not be currently possible. I'd imagine you could replace the time value and have the saved search just look back a set amount, but not sure. That might get you where you need to go.

5

Ok, using 7.x here, but it should probably work find in 8.x as well. From Discover you should be able to Share the snap shot, from there you'll see a "time" section in the URL. You'll want to set the "to" section to an absolute time and have "from" be relative. For example this would search from today at 17:00 to back 4 days.

time:(from:now-4d%2Fd,to:'2023-03-23T17:00:00.000Z')

I was able to successfully change those settings in the URL and see them take effect in the browser. Good luck.