Obtaining the Index Pattern ID

[greut]

Hi, in our migration process from old ES 5 to shiny ES 7, the URL we build in the alerts are broken and I didn't find the easy way of solving thing.

Basically, previously the index field was used to create the document URL, such as /kibana#/doc/{index}/{_index}/{type}?id={_id}

And know index contains system-logstash-* when we are looking for the UUID value, aka Index Pattern ID.

Any ideas? Help is much appreciated.

[jertel]

Are you using the Kibana URL generator? https://elastalert2.readthedocs.io/en/latest/ruletypes.html#generate-kibana-discover-url

[nsano-rururu]

@greut

Certainly it is troublesome to look up the index ID.
I will try to move it with the index pattern name. If we can handle it, we will issue a pull request.

[nsano-rururu]

If you want to use the pattern name, we will add the index pattern name because it seems that you can set the advanced custom index pattern ID option.

[nsano-rururu]

This is the index pattern ID that the Kibana Discover application links to, but I've found that if you use the pattern name, you can set it using the advanced custom index pattern ID option. If set using the advanced custom index pattern ID option, the setting will be the index pattern ID.

alert:
  - "slack"
alert_subject: "Test {0} 123 {1} aa"
alert_subject_args:
  - "message"
  - "@timestamp"
alert_text: "Test {0}  123 {1} bb"
alert_text_args:
  - "message"
  - "@timestamp"
filter:
  - query:
      query_string:
        query: "message:Quit AND @log_name:mysqld.general"
generate_kibana_discover_url: True
import: "BaseRule.config"
index: "mariadblog-*"
is_enabled: true
kibana_discover_app_url: "http://localhost:5601/app/discover#/"
kibana_discover_from_timedelta:
  minutes: 10
kibana_discover_index_pattern_id: "test_index_ptn_name"
kibana_discover_to_timedelta:
  minutes: 10
kibana_discover_version: "7.12"
mattermost_attach_kibana_discover_url: false
name: "a"
num_events: 2
realert:
  minutes: 5
slack_webhook_ur: "https://xxxx"
slack_attach_kibana_discover_url: True
slack_ca_certs: false
slack_channel_override: "#abc"
slack_emoji_override: ":ghost:"
slack_ignore_ssl_errors: false
slack_kibana_discover_color: "#ec4b98"
slack_kibana_discover_title: "Discover in Kibana"
slack_msg_color: "danger"
slack_parse_override: "none"
slack_timeout: 10
slack_title_link: "http://127.0.0.1:8080/rules/a"
slack_username_override: "elastalert"
terms_size: 50
timeframe:
  minutes: 5
timestamp_field: "@timestamp"
timestamp_type: "iso"
type: "frequency"
use_strftime_index: false

[greut]

Finding the ID (my first screenshot) is not that hard; I was looking for a way to not put it in the configuration file as we are currently using the human name, such as logstash-*. The goal would be to use the human name in place of the kibana_discover_index_pattern_id and let Elastalert infer it for us.

[JeffAshton]

Instead of trying to find the index pattern ID in the url, I suggest controlling what the index pattern ID is at creation time. There is an advanced option in the Kibana interface.