# Using urlparam in an Elasticsearch SQL query in Kibana Canvas

**URL:** <https://discuss.elastic.co/t/using-urlparam-in-an-elasticsearch-sql-query-in-kibana-canvas/204816>\
**Category:** Kibana\
**Tags:** canvas\
**Created:** [October 23, 2019, 8:01am UTC](https://discuss.elastic.co/t/using-urlparam-in-an-elasticsearch-sql-query-in-kibana-canvas/204816 "2019-10-23T08:01:01Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [October 23, 2019, 12:29pm UTC](https://discuss.elastic.co/t/using-urlparam-in-an-elasticsearch-sql-query-in-kibana-canvas/204816/2 "2019-10-23T12:29:55Z")

</div>

Hey @Sahiru_Gunawardene, welcome to the discussion boards!

Give this syntax a try. I do want to caution you though -- this is **widely considered unsafe** , as you are taking data from the URL (which the user controls) and injecting it into a SQL query:

```auto
filters
| essql
query={string "SELECT project, release, sum(effort) FROM my_index where field= '" {urlparam param=varFromURL default=1000} "' group by field1, field2"
| table
| render

```

---

_[View the full topic](https://discuss.elastic.co/t/using-urlparam-in-an-elasticsearch-sql-query-in-kibana-canvas/204816)._