Question about creating a link to document in Kibana

[reswob]

Regarding the discussion below and the creation of a link directly to a document.

Alert to contain link to Kibana search results

Hello, Is there an easy way to have a Watcher action (let's say webhook) that can generate a link to Kibana with the query matching the data that triggered the alert? The idea being, I want to send a notification of new errors in logs, and the notification should contain a link - clicking this link should execute the search that triggered the alert. Thanks, Andrey

So I have created a link that works going to a specific document based on the 'share' capability in Kibana (note that the index is specified rather than using a wild card):

http://ip:5601/app/kibana#/discover?_g=(time:(from:now-1w,mode:quick,to:now))&=(columns:!(_source),index:logstash-2018-05-15,interval:auto,query:(query_string:(analyze_wildcard:!t,query:'_id:12k24j2l35k2l')))

While this works, I get an orange error that says

Discover: "logstash-2018-05-15" is not a configured pattern ID. Using the default index pattern: "23daslkj234jrlew"

This default index pattern isn't shown in the document details, how do I get a list of all my default index patterns?

The reason I'm doing this is because when I create an alert to send to someone based on a singe document, I want to link back to that document without having to build a dashboard.

Also, note that using a wildcard in the above search doesn't work.

index:logstash-*

This gives an "unable to parse url" error

[Bargs (Matt Bargar)]

23daslkj234jrlew is the ID of your default index pattern (different from its human readable name). The index parameter in the url requires this ID. The default index pattern is whichever one you selected in the management section of Kibana.

This might probably be problematic for you if you have a large number of index patterns, because I don't think Watcher will expose this information. If you only have a small number of index patterns and can hard code this index ID into your alerts, you can find the ID of each one of your index patterns in the Management section of Kibana. In Management select the "Index Patterns" link, then select the pattern you're interested in the sidebar, then look at the URL. The long string of numbers and letters in the URL is the ID.