Hyperlink field combining multiple fields in query string

[thegrockq]

I'm trying to add a hyperlink field to Kibana where the values of multiple fields are used to construct the query string. For example, I need to do something like this:

Sample Fields

id: 135805885
session: 08801509951900395808
start_date: 2018/06/19 13:33:16
end_date: 2018/06/19 13:33:16

Desired URL

https://xx.yy.com/some/path?id=135805885&session=08801509951900395808&start_date=2018%2F06%2F19%2013%3A33%3A16&end_date=2018%2F06%2F19%2013%3A33%3A16

I've tried using LS to add a field where I build the query string, but then the entire query string is encoded and the hyperlink doesn't work as intended (i.e. the "=" and "&" are also URL encoded).

I attempted to use {{rawValue}} instead of {{value}} in Kibana, in hopes I could manually encode in LS using gsub for the chars I know will show up, but it didn't seem to work as expected (I expected the query string to be fully unencoded). I'm on ES 5.6.3.

Am I likely doing something wrong with the {{rawValue}}? Is the 'manual' gsub encoding in LS the best way to go?

Also - the start_date and end_date fields are actually sent as UNIX timestamps, and show up this was in Kibana when viewed as JSON, but they are displayed in the proper format in the table view and also in URL formatted string Kibana creates. Will I need the conversion in LS before I do the gsub, if I go that route?

[Bill_McConaghy]

I've moved this question to the Logstash forum as you will likely get a better answer there.

[yodog]

Add_field to add a custom hyperlink

Is there any way to add a hyperlink to the data table? A clickable hyperlink? I am concatenating the field called Id, which lives in my document. I can get a url into the document, but it's not clickable, it's just plain text. This is what I am using: filter { mutate { add_field => { "data Record" => "https://hyperlink_url/%{Id}" } } }

Make a value field in Kibana 4 clickable to follow link

I have a large number of webserver logs in elasticsearch and am using kibana 4 to explore them and look for different referral URLs. I occasionally want to click on the URL's. Right now I have to copy and paste them into another tab in my browser. It would be great if I could just click on them and have it open a new tab or at least in the current tab. I have made one other modification to the kibana code base so far and I'm starting to get the hang of it. I still unsure where everything is but …

[thegrockq]

I know how to do this (and am doing this) for a single field. The issue is I specifically need values from multiple fields, and I specifically need them in a query string (where values like literal spaces, for example, are URL encoded as %20).

So far, if I build the query string in LS (which I'm doing), the whole field is URL encoded by Kibana. In Kibana, I can't build the query string using multiple fields with a field format formatter in Kibana (AFAIK).

[thegrockq]

Thanks Bill.

I think there are two components to this, one LS and one Kibana. From the Kibana side, should using the URL field formatter, and {{rawValue}} as opposed to {{value}} to build the URL, result in a URL that is NOT URL encoded?

If so, I think I can figure this out, but so far, when I switched, it still appears to encode... Not clear what the expected output should be.

Thanks!

[Bill_McConaghy]

I think rawValue should work and not encode the value. Sounds like maybe that is not the case though. If you find issues with rawValue that sounds like a bug to me.