I am using the Graph application in a way that the end result is I have selected a single node which is essentially an email address. In this example we're going to say that email address is mike.smith@email.com. I have set up a drill-down so that I can go from Graph to a Kibana dashboard which is filtered using the email address selected in Graph. I can hard code the drill-down url and it works as expected. The URL looks as such:
(two notes. i have omitted the leading part of the url as its not relevant. I have made this url decoded as its easier to read, but the url used in Graph is encoded.)
_g=(filters:!(('$state':(store:globalState),meta:(alias:!n,disabled:!f,index:user,key:person.email_address.keyword,negate:!f,params:(query:'mike.smith@email.com',type:phrase),type:phrase,value:'mike.smith@email.com'),query:(match:(person.email_address.keyword:(query:'mike.smith@email.com',type:phrase))))),refreshInterval:(pause:!t,value:60000),time:(from:now-1y,to:now))
When using that, I am taken to the appropriate dashboard with the filter appropriately applied. The obvious problem here is that the email address is hard coded, so any time I select a user other than mike.smith@email.com, it won't work as expected. What I attempted to do was use the {{gquery}} variable to dynamically place the email address of the selected node from Graph into the URL. The updated URL looks as such, which is essentially the same as above just replacing mike.smith@email.com with {{gquery}}:
_g=(filters:!(('$state':(store:globalState),meta:(alias:!n,disabled:!f,index:user,key:person.email_address.keyword,negate:!f,params:(query:'{{gquery}}',type:phrase),type:phrase,value:'{{gquery}}'),query:(match:(person.email_address.keyword:(query:'{{gquery}}',type:phrase))))),refreshInterval:(pause:!t,value:60000),time:(from:now-1y,to:now))
This did not work as expected. In two of the three places, the literal "{{gquery}}" is plugged into the filter, and not the value of the email address coming from Graph. What I discovered is that it appears as though {{gquery}} can only be used once in the URL. After that, it is interpreted literally as "{{gquery}}". Is this intended functionality or is this possibly a bug? Since the Kibana url requires the actual email address plugged into 3 places, but gquery can only be used once, it makes it impossible to dynamically set the value in all 3 spots in the url.
For anybody looking for a workaround, you can set two of the email address parameters to a space (or %20). Note, that NULL did not work. The one spot where gquery has to be used is in the part of the url that sets the Query DSL of the filter. The negative of this is that while it works, the filter on the dashboard doesn't visually show what value is being filtered on. Here is the encoded url for this workaround:
_g=(filters%3A!(('%24state'%3A(store%3AglobalState)%2Cmeta%3A(alias%3A!n%2Cdisabled%3A!f%2Cindex%3Auser%2Ckey%3Aperson.email_address.keyword%2Cnegate%3A!f%2Cparams%3A(query%3A'%20'%2Ctype%3Aphrase)%2Ctype%3Aphrase%2Cvalue%3A'%20')%2Cquery%3A(match%3A(person.email_address.keyword%3A(query%3A'{{gquery}}'%2Ctype%3Aphrase)))))%2CrefreshInterval%3A(pause%3A!t%2Cvalue%3A60000)%2Ctime%3A(from%3Anow-1y%2Cto%3Anow))