# Logstash email hyperlink length limit

**URL:** <https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271>\
**Category:** Logstash\
**Created:** [February 7, 2017, 7:06pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271 "2017-02-07T19:06:38Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 7:06pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/1 "2017-02-07T19:06:38Z")

</div>

The email plug is working fine. I would like to add a hyperlink to Kibana to allow the user to display a Visualization.  
All of that works, except the hyperlink is truncated in the Outlook email.  
I have investigated different ways to shorten the URL. I cannot use solutions such as tinyurl for security reasons.  
Do you have any suggestions?

Here is a Discovery example, which is as short as they get:

```
            if "_grokparsefailure" in [tags] {
                    grok {
                            match => { "message" => "%{GREEDYDATA:err_num}:%{SPACE}%{GREEDYDATA:narrative}" }
                            remove_tag => ["_grokparsefailure"]
                            add_field => ["tags", "grok0714"]
                    }

                    if( "grok0714" in [tags] ){

                            if( "Error" in [err_num] ){

                                    if( "No space left on device" in [narrative] ){

                                            mutate{
                                                    ### Replacing msg_level with err_num because it is blank. 2/7/2017 - Brian
                                                    replace => { "msg_level" => "%{err_num}" }
                                                    add_field => ["[@metadata][my_body]", "

```

[http://XXX.XXX.XXX.com:5602/app/kibana#/discover?\_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now))&\_a=(columns:!(component,host,err\_num,narrative,tags),index:'dplr-%{ENVIRONMENT}-logstash-\*',interval:auto,query:(query\_string:(analyze\_wildcard:!t,query:'host:%20"%{host}"%20AND%20err\_num:%20"%{err\_num}"')),sort:!('@timestamp',desc))](http://XXX.XXX.XXX.com:5602/app/kibana#/discover?_g=%28refreshInterval:%28display:%271%20minute%27,pause:!f,section:2,value:60000%29,time:%28from:now-1h,mode:quick,to:now%29%29&_a=%28columns:!%28component,host,err_num,narrative,tags%29,index:%27dplr-%25%7BENVIRONMENT%7D-logstash-*%27,interval:auto,query:%28query_string:%28analyze_wildcard:!t,query:%27host:%20%22%25%7Bhost%7D%22%20AND%20err_num:%20%22%25%7Berr_num%7D%22%27%29%29,sort:!%28%27@timestamp%27,desc%29%29)  
"]  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 7:17pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/2 "2017-02-07T19:17:29Z")

</div>

So... it's Logstash that's truncating the string?

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 7:28pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/3 "2017-02-07T19:28:58Z")

</div>

I am not sure.  
If I send it in an anchor tag, the text of href is truncated.

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 7:30pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/4 "2017-02-07T19:30:35Z")

</div>

Here is the body of the email:

HP-UX Error: 28 from [hltv0777.hydc.sbc.com](http://hltv0777.hydc.sbc.com):/opt/app/globalid/data/server/Release-9-0/logs/135.213.40.121\_45402\_exception.log  
Visualization [http://blpi165.bhdc.att.com:5602/app/kibana#/visualize/create?type=histogram&indexPattern=dplr-%{Test}-logstash-](http://blpi165.bhdc.att.com:5602/app/kibana#/visualize/create?type=histogram&indexPattern=dplr-%25%7BTest%7D-logstash-)_&\_g=%28refreshInterval:%28display:%271%20minute%27,pause:!f,section:2,value:60000%29,time:%28from:now-1h,mode:quick,to:now%29%29&\_a=%28filters:!%28%29,linked:!f,query:%28query\_string:%28analyze\_wildcard:!t,query:%27host:%20%[22hltv0777.hydc.sbc.com](http://22hltv0777.hydc.sbc.com)%22%20AND%20err\_num:%20%22HP-UX Error: 28%22%27%29%29,uiState:%28%29,vis:%28aggs:!%28%28id:%271%27,params:%28%29,schema:metric,type:count%29,%28id:%272%27,params:%28customInterval:%272h%27,extended\_bounds:%28%29,field:%27@timestamp%27,interval:auto,min\_doc\_count:1%29,schema:segment,type:date\_histogram%29,%28id:%273%27,params:%28field:host.raw,order:desc,orderBy:%271%27,size:5%29,schema:group,type:terms%29%29,listeners:%28%29,params:%28addLegend:!t,addTimeMarker:!f,addTooltip:!t,defaultYExtents:!f,mode:stacked,scale:linear,setYExtents:!f,shareYAxis:!t,times:!%28%29,yAxis:%28%29%29,title:%27New%20Visualization%27,type:histo! gram%29%29  
Discovery [http://blpi165.bhdc.att.com:5602/app/kibana#/discover?\_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now))&\_a=(columns:!(component,host,err\_num,narrative,tags),index:'dplr-%{Test}-logstash-](http://blpi165.bhdc.att.com:5602/app/kibana#/discover?_g=%28refreshInterval:%28display:%271%20minute%27,pause:!f,section:2,value:60000%29,time:%28from:now-1h,mode:quick,to:now%29%29&_a=%28columns:!%28component,host,err_num,narrative,tags%29,index:%27dplr-%25%7BTest%7D-logstash-)_%27,interval:auto,query:%28query\_string:%28analyze\_wildcard:!t,query:%27host:%20%[22hltv0777.hydc.sbc.com](http://22hltv0777.hydc.sbc.com)%22%20AND%20err\_num:%20%22HP-UX Error: 28%22%27%29%29,sort:!%28%27@timestamp%27,desc%29%29  
Narrative:  
No space left on device  
JavaClass:  
%{javaclass}  
Tags:  
grok0714

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 7:35pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/5 "2017-02-07T19:35:34Z")

</div>

Okay... but has that URL really been concatenated? It ends with "%27,desc%29%29" in your Logstash config and in your sample email body.

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 7:37pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/6 "2017-02-07T19:37:21Z")

</div>

Apparently not. This may be an issue with Outlook.  
Has anyone been able to email hyperlinks?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 8:40pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/7 "2017-02-07T20:40:26Z")

</div>

Surrounding the URL by angle brackets might help.

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 10:54pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/8 "2017-02-07T22:54:13Z")

</div>

Thanks for your patience. Embedding the URL in a table surrounded by

 tags is the secret:

dplrgid8@:/home/dplrgid8/logstash/dev/templates/$ cat example.my\_body.txt

```
                    if( "grok0714" in [tags] ){

                            if( "Error" in [err_num] ){

                                    if( "No space left on device" in [narrative] ){

                                            mutate{
                                                    ### Replacing msg_level with err_num because it is blank. 2/7/2017 - Brian
                                                    replace => { "msg_level" => "%{err_num}" }
                                                    add_field => ["[@metadata][my_body]", "
            <html>
            <body>
                <table style=width:\"100%\">
                    <tr>
                            <td><pre>%{err_num} from %{host}:%{path}</pre></td>
                    <tr>
                            <td><b>Copy & Paste Visualization Link to FireFox Browser:</b></td>
                    <tr>
                            <td>http://xx.xx.xx.com:5602/app/kibana#/visualize/create?embed=true&type=histogram&indexPattern=dplr-qa-logstash-*&_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now))&_a=(filters:!(),linked:!f,query:(query_string:(analyze_wildcard:!t,query:'host:%20%22hltv0777.hydc.xx.com%22%20AND%20err_num:%20%22HP-UX%20Error:%22')),uiState:(),vis:(aggs:!((id:'1',params:(),schema:metric,type:count),(id:'2',params:(customInterval:'2h',extended_bounds:(),field:'@timestamp',interval:auto,min_doc_count:1),schema:segment,type:date_histogram),(id:'3',params:(field:host.raw,order:desc,orderBy:'1',size:5),schema:group,type:terms)),listeners:(),params:(addLegend:!t,addTimeMarker:!f,addTooltip:!t,defaultYExtents:!f,mode:stacked,scale:linear,setYExtents:!f,shareYAxis:!t,times:!(),yAxis:()),title:'New%20Visualization',type:histogram))</td>
                    <tr>
                            <td><b>Copy & Paste Discovery Link to FireFox Browser:</b></td>
                    <tr>
                            <td>http://xx.xx.xxcom:5602/app/kibana#/discover?_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now))&_a=(columns:!(err_num,type,narrative),index:'dplr-qa-logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'err_num:%20%22HP-UX%20Error:%2028%22%20AND%20type:%20%22habitat.exception%22%20AND%20%20host:%20%22hltv0777.hydc.xx.com%22')),sort:!('@timestamp',desc))</td>
                    <tr>
                            <td><b>Narrative:</b></tb>
                    <tr>
                            <td><pre>%{narrative}</pre></td>
                    <tr>
                            <td><b>Tags:</b></tb>
                    <tr>
                            <td><pre>%{tags}</pre></td>
                </table>
            </pre>
            </body>
            </html> " ]
                                            }

                                            throttle {
                                                    before_count =>-1 
                                                    after_count => 1
                                                    period => "3600"
                                                    key => "%{narrative}"
                                                    add_field => ["tags", "throttled"]
                                            }
                                    }
                            }
                    }
            }

```

Results in:

HP-UX Error: 28 from [hltv0777.hydc.sbc.com](http://hltv0777.hydc.sbc.com):/opt/app/globalid/data/server/Release-9-0/logs/135.213.40.121\_45402\_exception.log  
Copy & Paste Visualization Link to FireFox Browser:  
[http://xx.xx.xxcom:5602/app/kibana#/visualize/create?embed=true&type=histogram&indexPattern=dplr-qa-logstash-\*&\_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now)](http://xx.xx.xxcom:5602/app/kibana#/visualize/create?embed=true&type=histogram&indexPattern=dplr-qa-logstash-*&_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now)))&\_a=(filters:!(),linked:!f,query:(query\_string:(analyze\_wildcard:!t,query:'host:%20%[22hltv0777.hydc.xx.com](http://22hltv0777.hydc.xx.com)%22%20AND%20err\_num:%20%22HP-UX%20Error:%22')),uiState:(),vis:(aggs:!((id:'1',params:(),schema:metric,type:count),(id:'2',params:(customInterval:'2h',extended\_bounds:(),field:'@timestamp',interval:auto,min\_doc\_count:1),schema:segment,type:date\_histogram),(id:'3',params:(field:host.raw,order:desc,orderBy:'1',size:5),schema:group,type:terms)),listeners:(),params:(addLegend:!t,addTimeMarker:!f,addTooltip:!t,defaultYExtents:!f,mode:stacked,scale:linear,setYExtents:!f,shareYAxis:!t,times:!(),yAxis:()),title:'New%20Visualization',type:histogram))

Copy & Paste Discovery Link to FireFox Browser:  
[http://xx.xx.xx.com:5602/app/kibana#/discover?\_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now)](http://xx.xx.xx.com:5602/app/kibana#/discover?_g=(refreshInterval:(display:'1%20minute',pause:!f,section:2,value:60000),time:(from:now-1h,mode:quick,to:now)))&\_a=(columns:!(err\_num,type,narrative),index:'dplr-qa-logstash-\*',interval:auto,query:(query\_string:(analyze\_wildcard:!t,query:'err\_num:%20%22HP-UX%20Error:%2028%22%20AND%20type:%20%22habitat.exception%22%20AND%20%20host:%20%[22hltv0777.hydc.xx.com](http://22hltv0777.hydc.xx.com)%22')),sort:!('@timestamp',desc))

Narrative:  
No space left on device

Tags:  
grok0714

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 11:01pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/9 "2017-02-07T23:01:51Z")

</div>

Also, some of the credit goes to using the "Share Link" feature of Kibana. It seems to do some magic, but the table is still required.

---

<div class="post-metadata">

**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\
**Post date:** [February 7, 2017, 11:18pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/10 "2017-02-07T23:18:30Z")

</div>

This still does not work dynamically, i.e., replacing field names with text.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2017, 11:18pm UTC](https://discuss.elastic.co/t/logstash-email-hyperlink-length-limit/74271/11 "2017-03-07T23:18:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.