Extension of kibana_discover_app_url

[bonkotu]

Hello,

I would like to add the time frame and filter set in Rule to the Kibana URL query generated by Elastalert.
Do you have any ideas?

[jertel]

See the Kibana link configuration in the ElastAlert 2 documentation.

[bonkotu]

@jertel

Thank you for your reply. Sorry, I missed it when I saw the documentation.

Thanks to that I found the time settings in the docs.
However, for filtering, I haven't found a setting that works for me. I understood that the current Elastalert does not allow adding query keys to URLs in Kibana 7.x version. Is my understanding correct?

[jertel]

It looks like the Kibana discover URL supports query key filters in some capacity, according to kibana_discover.py.

However, the Kibana dashboard URL appears to only support query_string, term, and range filters, according to kibana.py.

Personally, I don't use either in my alerts so I'm not able to offer much assistance on this.