src_url for Kibana

[kbiedermann]

I'm confused by the src_url format and am looking for examples for kibana.

From the docs:
src_url requires the following format specifiers: 's', 'd', 'd'.
Ex: 'https://localhost/?query=%s&from=%d&to=%d'

[ekoyle]

Those are printf-style format specifiers. The %s is for a string, %d is for an integer.

Whatever string you give it will have the three items substituted, and will need to have all three in the same order. I'm assuming from the example that the first argument is a string containing the query, the second argument is an integer indicating the starting time, and the third argument is an integer indicating the ending time.

Generally, when using an integer to indicate a time, they use Epoch Time (ie. seconds since 00:00:00 UTC on Jan 1 1970).

[kiwiz]

WIP. Alerts in 411 should contain the source _id field whenever possible. This makes it easy to find alerts derived from an individual document.