I notice that the format of the discover URL parameters is RISON, but there is no documentation around the structure of this object. It doesn't appear to be a raw ES query object converted from JSON to RISON. Aside from reverse-engineering by reading the source code - is there any public documentation available for this?
I'm trying to figure out how to programmatically generate a Kibana Discover URL based on this structure.
My use-case is:
- ELK is aggregating log information to a central place.
- An error occurs on an application server.
- An email is sent with the corresponding Kibana Discover URL which narrows down the time-frame and applies some filters.
- An engineer clicks on the URL and is able to quickly get the log information they need to debug the situation.
I think for now, I would just create a template URL by looking up a particular issue and extracting out the necessary parameters for my particular use-case. But the parameter has a very rich syntax for describing the query and filters - so I'd like to know more about it to take full advantage.