Hyperlink field combining multiple fields in query string

I'm trying to add a hyperlink field to Kibana where the values of multiple fields are used to construct the query string. For example, I need to do something like this:

Sample Fields

id: 135805885
session: 08801509951900395808
start_date: 2018/06/19 13:33:16
end_date: 2018/06/19 13:33:16

Desired URL


I've tried using LS to add a field where I build the query string, but then the entire query string is encoded and the hyperlink doesn't work as intended (i.e. the "=" and "&" are also URL encoded).

I attempted to use {{rawValue}} instead of {{value}} in Kibana, in hopes I could manually encode in LS using gsub for the chars I know will show up, but it didn't seem to work as expected (I expected the query string to be fully unencoded). I'm on ES 5.6.3.

Am I likely doing something wrong with the {{rawValue}}? Is the 'manual' gsub encoding in LS the best way to go?

Also - the start_date and end_date fields are actually sent as UNIX timestamps, and show up this was in Kibana when viewed as JSON, but they are displayed in the proper format in the table view and also in URL formatted string Kibana creates. Will I need the conversion in LS before I do the gsub, if I go that route?

I've moved this question to the Logstash forum as you will likely get a better answer there.

I know how to do this (and am doing this) for a single field. The issue is I specifically need values from multiple fields, and I specifically need them in a query string (where values like literal spaces, for example, are URL encoded as %20).

So far, if I build the query string in LS (which I'm doing), the whole field is URL encoded by Kibana. In Kibana, I can't build the query string using multiple fields with a field format formatter in Kibana (AFAIK).

Thanks Bill.

I think there are two components to this, one LS and one Kibana. From the Kibana side, should using the URL field formatter, and {{rawValue}} as opposed to {{value}} to build the URL, result in a URL that is NOT URL encoded?

If so, I think I can figure this out, but so far, when I switched, it still appears to encode... Not clear what the expected output should be.


I think rawValue should work and not encode the value. Sounds like maybe that is not the case though. If you find issues with rawValue that sounds like a bug to me.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.