Provide drilldown capability for Saved Search panels on a Kibana Dashboard

[jeffvestal]

Describe the feature: I would like to drilldown from a "Saved Search" panel on a Kibana dashboard

Describe a specific use case for the feature: I have a transform that provides monitoring data information with the cluster as an entity. On an Operational dashboard, I would display this data frame index (transform output) as a Saved Search panel. When I want to "drilldown" on a cluster, I would like to be able to link to the Stack Monitoring app for that specific cluster (using cluster_uuid as part of the url). I would take an arbitrary url with the ability to embed context to complete the url

Other transform saved search panels would benefit from the ability to link back to Discover to view the original source documents that fed into the transform. linking to another dashboard for additional context, or other Solution apps.

---

Part of : https://github.com/elastic/kibana/issues/42845 https://github.com/elastic/kibana/issues/55324 https://github.com/elastic/kibana/issues/78289

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[streamich]

@jeffvestal it looks like you have a number of use cases:

• For navigating to Discover we will release in 7.9 “Explore underlying data” action. (Not sure if it supports saved searches.)
• We have also a ticket for Discover drilldown, where user will be able to configure a drilldown to a specific saved search (but currently Discover drilldown has low priority, likely not making it next couple of minors).
• Linking to Stack monitoring app — we could create an action or drilldown to navigate to Stack Monitoring app from dashboard. Thanks for bringing up this use case, it wasn't something we considered before.
• For navigating to an arbitrary URL — we are currently working on a generic URL drilldown which would allow user to navigate anywhere from Dashboard, carrying over some dashboard context. Once we release the MVP, we have a follow up planned to specifically improve the URL drilldown to work well for internal links within Kibana.
• For linking to other solutions apps — solutions apps can today build their own actions and drilldowns. Once we have URL drilldown, one will also be able to use that to navigate to solution apps.
• Another idea that we currently have in planning/brainstorming phase is "in-panel drilldown", where a drilldown would update a view of some panel instead of navigating to a different dashboard (maybe that also relates to your use cases).

[jeffvestal]

Thanks for the extra info @streamich! There definitely are a few different use cases.

I did see the couple issues you linked, which will address some of the potential uses for drilldowns here. I didn't see any of them mention Saved Search panels specifically, so I wanted to call that out. Having custom urls with context loading will be very helpful.

I really like the idea of in-panel drilldowns. If you look at the second screen shot I originally posted, the bottom panel has Node specific metrics (heap, fs, load). I had one user ask for the ability to click on a cluster_name from the "Clusters" panel, and then show all the nodes associated with that cluster and their metrics. So being able to drill down by a cluster name, and redraw that panel with the filtered node info panel below it would be very slick.

[bradyguy]

I would like to see a similar capability. I have a basic dashboard that filters using controls a saved search. I would like to be able to take a row from that saved search and be able to drill down using 4 or 5 fields from that row to filter another search. One record in my saved search could result in another search of about 10 to 15 records. So basically being able to drill down from a saved search record, using fields from that record to filter the next saved search.

[glazou]

I would also like to see drilldown on saved search.

Let's say, I have a saved search with 4 columns: alert_id, server_id, alert_category, timestamp

I would like to be able to configure the drilldowns to be performed on each column (alert_id would drilldown to an "Alert dashboard", server_id would drilldown to a "Server dashboard", no drilldowns on other columns).

Alternatively, I would like to be able to configure an additional 'drilldown' column that would list all the drilldowns for the whole row: Alert dashboard, Server dashboard. Seems like it would make drilldowns a bit more discoverable on large table that can be a bit intimidating.

Many thanks for this wonderful new capability

[mbudge]

It would be good if users could use drill-downs from the options menu as well as the field level.

That way users can apply multiple filters before going to the options menu to move to another dashboards.

Currently they have to apply the filters to the query, then click on one of the fields to find the drill-down menu.

Having the drill-down menu in options would allow drill-downs to work with both visuals and saved search dashboards.

The user would be able to move to any dashboard of their choosing. Not just the dashboards paths configured for them.

[mvanderlee]

You can use Scripted Field for this:

[m-adams]

I was just discussing this requirement today.

The requirement is you have a dashboard and you use elements to filter the data until you find an interesting item. You then want to shift to a detailed analysis view dashboard using drilldown but filtered on an element of that document. Maybe you want to only see that specific document in a detailed view so you could pick the doc id. There may also be scenarios where you want to jump to a new dashboard using an alement of the doc e.g. a category.

You can just about achieve that through building an aggregation viz based on the doc id and using that to drill down but it's clunky and means creating inneficient aggs that run on every load of the dashboard.

[defutek-tj]

Any update on this request? Is it on the roadmap? We have a customer that is requesting this capability.

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)