In the previous article, “Kibana: Creating a link to Drilldown-version 7.11 for Dashboard,” I showed you how to use drilldown with an argument URL. In many cases, in dashboards, there is a visualization of tables. So how do we provide visualization for the items in the table? For example, in the table, there is an IP address, and when we click on a row of the table, it will start displaying specific information about the IP of the current row. Note that we must use version 7.11 and above to perform the following exercises.

 

Prepare data and visualization

In today’s exercise, we will continue to use the native Kibana data we used in the previous tutorial “Kibana: Creating a link to Drilldown-7.11 version for Dashboard”. Import data by following the previous steps. Next, we need to create a table with an IP address:

Drag the IP into the display area as above. We change the display name to IP Address:

In the same way, we drag the Client OS, Referer, and Bytes into the display area:

It ended with this:

We saved the current visualization and added it to the [Logs] Web Traffic Dashboard:

 

Create a Single click drilldown

 

Above, we fill in the following URL template:

https://www.whois.com/whois/{{ event.value }}
Copy the code

Click Create Drilldown. So we create the URL drilldown. Save the current dashboard:

Click the + symbol above:

It automatically redirects to a page showing details of the current IP. Of course, when creating drilldown, we could have chosen to open it on a different TAB.

 

Create table row click drilldown

The above method is useful in many situations. But there is a case above where we click on an item in another column, such as ios:

On top it also shows a menu option Whois IP. This may not be what we want, for example when we select this menu, it says:

It still shows some information, but it is not what we originally intended to query the IP address. The IP address value exists in the first column. So how do we solve this problem?

The answer is: we can create a table row click drilldown. Let’s go back to the dashboard:

 

Create a table row drilldown:

We can click Add Variable above to find the variables that can be used. For example, event.values above:

https://www.whois.com/whois/{{ event.values.[0] }} 
Copy the code

Above, event.values[0] represents the first case, of course for the second column it is event.values[1], and so on.

Save the current dashboard:

Click on the three dots to the right and we’ll see a menu option called Whois IP. Click on this menu:

We’ll see that it opens the desired link directly and displays the DETAILS of the IP address of the current row.