How to send a link with time that watcher check

Elastic Stack Elasticsearch
1

Hello all,
We have watchers that send us the notifications with link to visualizations. Almost all watchers check period like "now-1h" or similar.

My question is: Is there any possible way that my watchers will send me links to those visualizations but with the time frame that this watcher has checked? Cause all our visualizations saved or unsaved with now-1h etc, but when I missed notification and then want to check those stats send in notification I will open that link and see period now-1h NOT those stats from that notification for that period when watcher find stats.

So I check link for visualization and see that it contains
https://kibana.......,**time:(from:'2018-09-13T00:00:00.000Z',mode:absolute,to:'2018-09-13T23:59:59.999Z'))**......

I think I can use their smth from output like ""result": { "execution_time":..." (so this can be used in
to:' {{ctx.execution_time}}) but I don't see in the same format "result": { "execution_time": -1h (for the part from...)

Can you advise if it can be done and how, thanks!

2

Hey,

you need an absolute timestamp in there as now would always be dependent when the user is clicking on the dashboard. So the best way would be to use ctx.execution_time as an absolute value.

Hope this makes sense.

--Alex

3

Thanks Alex,

That's how I think to try to do. But I faced with situation:
the link contains next (example if we use to check from now -1d to now):

https://kibana.......,time:(from:now-1d,mode:relative,to:now))&_a=(filters...

From output I can take, as you also suggest, {{ctx.execution_time}} and put it instead of now (in output of watcher the format of execution_time is 2018-10-09T00:00:00.000Z) (as I understand till execution time data was taken and check - so it is now).
Then I can change mode:relative to -> mode:absolute.
But still confused how to change part from:now-1d.
I know I can save the visualization with some time frame and share link to users and when they open will see my time frame (despite actually when they open it). So I thought it can be done in watcher somehow

4

UPDATE

Seems I found how to do it:

"https://kibana.......,time:(from:'{{ctx.execution_time}}||-1d',mode:absolute,to:'{{ctx.execution_time}}'))&_a=(fil.....

So I use here from:'{{ctx.execution_time}}||-1d' and the link that comes with alert works (time period in visualization doesn't change whether I open it in few sec or in few minutes later after alert)

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.