Link to a specific document

[tkuther]

I wonder if "Method 2" from Rashid's comment in #168 could be made sort of a hidden default, and used to create a "Link to result" based on the (hidden) _id field, for each row.

This would be incredibly usefull. At least our admins really miss this feature to show some specific event (mostly error messages) to some developers. Currently we have to look at the raw message, do a search "_id:" and then use the "share" link. Quite complicated.

At least a "show only this event" that does a query on the _id of the given event would be good to have already.

[davux]

Sorry, I created #721 before noticing you created this one. The two ideas are a bit different, but I'd rather participate to this discussion so I closed the one I created. Here is my proposal:

It would be great to have a notion of "link to a document".

The URL should be derived from the document id only (no dashboard). Of course, when clicked from within a dashboard, such links would "pop-over" the dashboard, but if you enter the permalink directly you should be able to view a standalone version of the document.

One use case would be to mention a document to other people. The table panel could also be configured to use such pop-over links instead of unfolding the line you clicked.

@gimpel: Does that sound good?

[tkuther]

Sounds good to me.

I think this could be kept very simple, like a special page that takes the required parameters, opens in a new tab, runs the search, and displays only the event's details table. No panels or other fancy dashboard stuff required. E.g. /event/show?index=logstash-xyz&id=TheHashOfTheEvent

[davux]

Oh, you're right about the index, it needs to be given in the URL as well.

But I'm not sure to understand: why run a search at all? A document exists by itself, you can simply query it in Elasticsearch with http://example.com:9200/index_name/_all/document_id and format it in HTML.

What I said about pop-overs is just that ajax technique based on onclick that's widely used for images, but it's just an implementation detail.

[rashidkpc]

This shouldn't be too hard at all. Might require a special panel for displaying just one even though? We could also just link directly to the elasticsearch GET response, which would be like one line of code.

[tkuther]

A direct link would be OK, but I guess proxying the elasticsearch query would be better for those using apache/nginx proxy to ES.

[davux]

@rashidkpc: I was more thinking of:

• if you enter the link directly: a standalone page (no dashboard or panel involved)
• if you click the link from within kibana: a popover window similar to the ones that appear when you click on a field name in the "Fields" column of the result list.

[awheeler]

I implemented something like this a little while ago, where I added the link in the event as a new view called share that was just a link:
View: Table / JSON / Raw / Share
The link would take you to a special logstash.json dashboard that understood both from/to URL args and was passed the elasticsearch _id, and the date/time range of the search that found the event.
But, I didn't really like how I did it, and much has changed in the code since then such that a pull is no longer a straight-froward proposition.

[cgagon]

Is milestone 5 going to support linking to event documents? I don't see a PR for #180.

[awheeler]

I've started work on this. First step is supporting url args for any dashboard:
awheeler@2b412a8
Next step is to add the share link.

[awheeler]

Added the share link, so inside an event it now looks like:
View: Table / JSON / Raw / Share
Please feel free to comment on the implementation in the pull request, or here.

[samdoran]

This would be incredibly helpful. As Kibana becomes more important to finding out what is happening on our systems, the need to easily share specific events is only going to increase. I really like the idea of a simple "Share" link on each event, like Alex has implemented in his PR.