Kibana dashboard URL with time filter

[mtudisco]

Hi,
I want to generate a URL for a kibana dashboard that pre-loads a specific time range, I have the time in time format when event occured and i want to display 2h less and 2h plus that time
Is there some way to generate it?
I can generate:

https://kibana-host:5601/app/kibana#/dashboard/36683f70-51ba-11ea-b9ea-cba503a0ab99?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'2020-03-13T15:34:19Z',to:'2020-03-13T15:34:19Z'))&_a=(query:(language:kuery,query:'some_field.keyword:"boo"'))

i see as well that i can use:

time:(from:now-4h,to:now-1h)

But it fails if i use:

time:(from:'2020-03-13T15:34:19Z'-4h,to:'2020-03-13T15:34:19Z')

or

time:(from:'2020-03-13T15:34:19Z-4h',to:'2020-03-13T15:34:19Z')

can anyone managed to build a URL like this?

thanks

[flash1293 (Joe Reuter)]

Datemath can't be mixed with static dates like this, you will have to do that calculation wherever you are generating those urls.

In Javascript for example it would work like this:

// give me the time four hours ago
const date = new Date("2020-03-13T15:34:19Z");
date.setHours(date.getHours() - 4);
const updatedISOString = date.toISOString();

[mtudisco]

Thanks Joe! i'm using elastalert and was trying to generate a URL in the email alert to take the notified person to see the information, dont think i can use javascript in elastalert

[flash1293 (Joe Reuter)]

Actually, maybe it is possible.

I just checked the code and it should work when the math part is separated by || from the static time part. Also see here: https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/date-math-expressions.html

Example: 2015-05-05T00:00:00||+1d-1m

Kibana doesn’t support the full datemath Elasticsearch does, but from what I can tell this specific thing should work (haven’t tested though). Sorry for my initial misleading answer, I was pretty certain that specific syntax was Elasticsearch only, but I’m not so sure anymore.

Let me know whether it works for your use case.

[mtudisco]

@mtudisco

https://kibana-host:5601/app/kibana#/dashboard/36683f70-51ba-11ea-b9ea-cba503a0ab99?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'2020-03-13T15:34:19Z||-4h',to:'2020-03-13T15:34:19Z||+1h'))&_a=(query:(language:kuery,query:'some_field.keyword:"boo"'))

Great Joe! that worked, i'm putting the code here for reference, in this case i used the date less 4h and plus 1h.

thanks a lot!