Getting alerts to use the Kibana server.publicBaseUrl?

[jeffmaley]

I'd like to have my alerts use the Kibana public URL instead of the host IP and I'm not having much luck. I've tried adding this to one of rules, but kibana_discover_url still shows the internal host IP. The kibana_discover_app_url is the internal host IP and I'm wondering if that's the issue. The actual public URL has a separate IAP in front of it and I can't see how to get elastalert2 to get through that.

generate_kibana_discover_url: true
kibana_discover_app_url: "http://:5601/app/discover#/"
kibana_discover_index_pattern_id: ""
kibana_discover_version: "8.10"

[jertel]

To clarify:

1. You want outgoing alerts (such as email or slack messages) to contain a Kibana URL that is accessing to the public Internet so alert recipients can click the link to pull up Kibana and see data related to the alert. Is this correct?
2. You have tried omitting the host and IP from the kibana_discover_app_url property, as you have shown above. You instead only include a port value. Is this correct? If so, this is invalid. It must be a valid URL with a host or IP.
3. The actual public URL limits who or what can access it via an IAP, but you want ElastAlert2 to be able to access that public URL? If so, why? What is ElastAlert2 itself going to do with it? I.e., why would ElastAlert2 itself need to contact Kibana (or are you using the URL shortener too?)
4. What specific error do you get when you set kibana_discover_app_url equal to the public URL?
5. Can you paste an actual rule config with redacted sensitive values showing xxx's in place of the actual sensitive value so I can have more confidence that I understand your scenario better?

Actual error screenshots or logs will help me better understand what you're running into.

[jeffmaley]

1. Yes
2. Well, no, I'd put when I pasted, but it looks like github just removed that entirely. Neat.
3. I'm not sure how elastalert2 uses the discover bit and thought it might need to contact kibana.
4. Ah, yes, well, I hadn't actually tested it. I assumed it wouldn't work. I just tested it now and it does, in fact, work if I just put the public url in there.

Lesson learned. Thanks!