Issues with setting up urltemplate in Kibana

Elastic Stack Kibana
1

Question 1: How to use fields from the document in urltemplate instead of {{value}}?

While configuring urltemplate in Kibana, I've encountered an issue. I'm attempting to include another field from the document in the query besides {{value}}. I've tried various methods such as

/app/discover#/?_a=(index:'0c024ee0-8f2e-4b51-97d6-1774cb6ffdf5',interval:auto,query:(language:kuery,query:'http.request.id:%20{{value}}%20or%20service.name:%20{{service.name}}'))
/app/discover#/?_a=(index:'0c024ee0-8f2e-4b51-97d6-1774cb6ffdf5',interval:auto,query:(language:kuery,query:'http.request.id:%20{{value}}%20or%20service.name:%20{{doc[service.name]}}'))
/app/discover#/?_a=(index:'0c024ee0-8f2e-4b51-97d6-1774cb6ffdf5',interval:auto,query:(language:kuery,query:'http.request.id:%20{{value}}%20or%20service.name:%20{{ctx.service.name}}'))
/app/discover#/?_a=(index:'0c024ee0-8f2e-4b51-97d6-1774cb6ffdf5',interval:auto,query:(language:kuery,query:'http.request.id:%20{{value}}%20or%20service.name:%20{{context.service.name}}'))

but nothing seems to work. Is there a way to utilize other fields from the document in urltemplate, apart from {{value}}?

Question 2: How to pass a date range other than _g=(time:(from:now-24h%2Fh,to:now))?

During the setup of urltemplate in Kibana, I have a question regarding passing a date range. Currently, I'm passing it in the format of _g=(time:(from:now-24h%2Fh,to:now)), but I would like to know if there are other methods to pass a date range in urltemplate?

ps: elastic/kibana 8.12.0

2

Hi @b2ron,

Current URL formatter supports only {{value}} or {{rawValue}} but it can't include other fields from the document. What can help to solve your case is to create a runtime field with a script which builds the required params list. And use this runtime field with a URL formatter.

Regarding the time range, you can set it in UI on a Discover page and then check how the current URL changes and copy that format.