search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.79k stars 8.19k forks source link

[OSQuery] View in Discover links broken for results #194492

Open nicpenning opened 2 weeks ago

nicpenning commented 2 weeks ago

Kibana version: 8.15.2 Elasticsearch version: 8.15.2 Server OS version: Windows Server 2019 Browser version: Edge latest Browser OS version: Edge latest Original install method (e.g. download page, yum, from source, etc.): Download page Describe the bug: When clicking on the View In Discover button in OSQuery, it seems that the link is broken (see screenshots).

Steps to reproduce:

  1. Run an OSQuery
  2. Click either View in Discover button
  3. See error

Expected behavior: I expect to open up in discover without issue.

Screenshots (if relevant):

Image Image

Image

Any additional context: I can't replicate this in a test environment. But I can share these links that seem to be very different: https://kibanaURL/app/discover#/?_g=h@80ea007&_a=h@7ceab63 --> Doesn't work in production, I see the error above trying to navigate to it.

https://testKibanaURL/app/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-undefineds,mode:absolute,to:now))&_a=(dataSource:(dataViewId:f01ed837-3008-4c5e-a5ab-bea7cf6edf4e,type:dataView),filters:!(('$state':(store:appState),meta:(alias:!n,disabled:!f,index:f01ed837-3008-4c5e-a5ab-bea7cf6edf4e,key:action_id,negate:!f,params:(query:'09fe7951-2710-4ac2-9bd5-6039775e580a'),type:phrase),query:(match_phrase:(action_id:'09fe7951-2710-4ac2-9bd5-6039775e580a'))))) --> Works in test and is a very different URL

Both Data Views exist in both environments except in our Production environment they have different dataViewIds.

elasticmachine commented 6 days ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 5 days ago

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)