Custom right click menus to link Kibana to other tools

[MattCarothers]

Describe the feature:

In order to integrate ELK effectively with our work flows, Kibana needs the capability to link to other tools. Security event monitoring is a great example. If I'm looking at intrusion detection system logs in Kibana, I should be able to right click an IP address and link to a whois query or any of the various internal web-based tools we use. As it stands now, the only way to investigate an issue would be to copy and paste, which is awkward and slow.

For any given field within a visualization, one should be able to define a template for the outbound URL. For example, if I have a field named "src_ip," I should be able to define a right click menu item along the lines of "http://network-tools.com/default.asp?prog=whois&host=%{src_ip}." Basic transformations such as normalizing to upper or lower case would also be nice.

[Bargs]

Have you considered using the URL field formatter?

I just created one like this:

[MattCarothers]

Neat. I hadn't seen that. It works well for the case where only a single outbound tool is needed, but at least for my applications we need many links for a given field. For reference, here's a screen shot of our commercial SIEM:

[Bargs]

Ah gotcha. I don't think we would override the right click menu, it's not a pattern we use elsewhere in Kibana. But I could definitely see a use case for some sort of expandable element with multiple options.

I'll leave this open since I think it would be useful to have in core, but I'll also mention that you could probably implement this yourself with custom field formatters

[MattCarothers]

Thanks. That's helpful. I think I can actually use custom field formatters to solve a completely unrelated problem I have today, which is converting ip addresses stored as 32 bit integers into dotted quads in a product that hasn't switched to the ip datatype.

[nwaringa]

Definitely would like to bump this one... We could also use this functionality.

[trevan]

I wonder if Kibana could add a plugin hook for the clicks? I'm thinking of having this just hooking into the current left-click functionality. Then plugins would be able to add context menus or additional features that either suplement the current functionality or replace it completely.

[nwaringa]

I wouldn't even mind it as a keyboard/click combo that opens a context menu to avoid cluttering up the baseline functionality of Kibana. If I could 'tab' right-click or left-click an item and be presented with a context menu that can be modified by the Admin (either in Kibana menus or via code on the back end) it would be really useful.

For our purposes... we would need to be able to tap the data as a variable that it could be forwarded to sites that lookup information. A good example of this would be leveraging the Kibana data to be sent via URL variable to Google's G Suite Toolbox (https://toolbox.googleapps.com).

We pondered just ingesting all the data... there are two reasons we can't: It is not static and changes quickly and it is not available in a format for mass import. It's more of an "analyze on the spot" type activity.

[thekofimensah]

This would be awesome to be able to have the ability to change the on-lick functionality of graphs on dashboards. I find it annoying for example that when I click on a date histogram chart, the query tries to filter by time and the field, where I'm only interested in the field. It would be great to be able to customize this sort of thing.

EDIT: Also just being able to right-click and open up a list of URL's that I'm interested in could be beneficial. Like to create a Jira/slack ticket with the body of the error log pasted in.

[alexfrancoeur]

Would the proposed solution in #12560 suffice for this use case? Is the ask for configurable on-click functionality or additional navigation options?

[nwaringa]

@alexfrancoeur It is close. What would be needed on this issue is a method to add external url links to the menu in #12560 and manipulate/utilize the data in the viz so that it could be shaped for external referrer usage. An example.... Taking an IP from a visualization and sending it to a DNS lookup website via the sites accepted URL variable construction to hunt for a result.

This method would probably need a right click menu configuration screen that reflects the URL field formatter function.

[timroes]

I will close this in favor #12560 so we don't fragment discussions of an early feature like drill downs to multiple issues.