investigate drill-down capabilities from Kibana to Moloch

[mmguero]

We've got drill-down capabilities from Moloch to Kibana:

• URL mapped in nginx.conf
• right-clicks added in moloch WISE data source

For a while I have been hoping we could get it going the other direction (Kibana to Moloch) but it's not yet supported as built-in feature of Kibana.

Recently though there was a comment about this project (goodlabs-studio/kibana-plugin-drilldownmenu) which might fit the bill.

I need to investigate this plugin and see if it would be a good fit to provide generic drill-down capabilities from Kibana to Moloch.

[mmguero]

I have got the plugin installing in the Kibana Dockerfile (see mmguero-dev@c66fec9) and have successfully done a drilldown by specifying a URL template / label template like:

URL template: /idkib2mol/zeek.orig_h == {{value}}
label template: Moloch: zeek.orig_h == {{value}}

(using zeek.orig_h as an example), and using an NGINX rewrite rule. You can see the fieldFormatMap stuff saved in the index-pattern:

▶ curl "http://$(dip malcolm_kibana_1):5601/kibana/api/saved_objects/index-pattern/sessions2-*" 
...
        {\"name\":\"zeek_x509.san_uri\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"zeek_x509.san_uri.text\",\"type\":\"string\",\"esTypes\":[\"text\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false,\"subType\":{\"multi\":{\"parent\":\"zeek_x509.san_uri\"}}}]",
      "fieldFormatMap": "{\"zeek.orig_h\":{\"id\":\"drilldown\",\"params\":{\"parsedUrl\":{\"origin\":\"https://malcolm.local.lan\",\"pathname\":\"/kibana/app/kibana\",\"basePath\":\"/kibana\"},\"urlTemplates\":[null,{\"url\":\"/idkib2mol/zeek.orig_h == {{value}}\",\"label\":\"Moloch: zeek.orig_h == {{value}}\"}]}}}"
    },
    "references": [],
    "migrationVersion": {
        "index-pattern": "7.6.0"
    }
}

The next step is to programmatically set all of those up in the index pattern creation.

[mmguero]

This issue in Malcolm depends on implementing this enhancement in Moloch, see arkime/arkime#1461