Document execution_context feature (#120894)

* document execution_context

* Apply suggestions from code review

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
Co-authored-by: Luke Elmers <lukeelmers@gmail.com>
Co-authored-by: Christiane (Tina) Heiligers <christiane.heiligers@elastic.co>

* format log output

* restructure pages

* Apply suggestions from code review

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
Co-authored-by: Luke Elmers <lukeelmers@gmail.com>
Co-authored-by: Christiane (Tina) Heiligers <christiane.heiligers@elastic.co>

docs/user/index.asciidoc

@@ -46,4 +46,5 @@ include::api.asciidoc[]
 
 include::plugins.asciidoc[]
 
-include::troubleshooting.asciidoc[]
+include::troubleshooting/index.asciidoc[]
+

docs/user/troubleshooting/index.asciidoc

@@ -0,0 +1,10 @@
+[[kibana-troubleshooting]]
+== Troubleshooting
+
+{kib} provides the following tools for debugging issues:
+
+* <<kibana-troubleshooting-kibana-server-logs, Using {kib} server logs>>
+* <<kibana-troubleshooting-trace-query, Trace {es} query to the origin in {kib}>>
+
+include::using-server-logs.asciidoc[]
+include::trace-query.asciidoc[]

docs/user/troubleshooting/trace-query.asciidoc

@@ -0,0 +1,44 @@
+[[kibana-troubleshooting-trace-query]]
+=== Trace {es} query to the origin in {kib}
+Sometimes the {es} server might be slowed down by the execution of an expensive query. Such queries are logged to {es}'s {ref}/index-modules-slowlog.html#search-slow-log[search slow log] file. But there is a problem: it's impossible to say what triggered a slow search request—a {kib} instance or a user accessing an {es} endpoint directly.
+To simplify the investigation of such cases, the search slow log file includes the `x-opaque-id` header, which might provide additional information about a request if it originated from {kib}.
+
+WARNING: At the moment, {kib} can only highlight cases where a slow query originated from a {kib} visualization, *Lens*, *Discover*, or *Alerting*.
+
+For example, if a request to {es} was initiated by a Vega visualization on a dashboard, you will see the following in the slow logs:
+[source,json]
+----
+"source": { "id": "c89d1ab3-b4a7-4920-a64a-22a910a413b0;kibana:application:dashboard:edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b;visualization:Vega:cb099a20-ea66-11eb-9425-113343a037e3" }
+----
+
+Take a closer look at the format of the string.
+The id value starts with  `c89d1ab3-b4a7-4920-a64a-22a910a413b0`, which is a unique identifier of a request set by the {kib} server.
+The part after the `kibana` prefix indicates that the request was triggered by *Dashboard* with id `edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b` and Vega visualization with id `cb099a20-ea66-11eb-9425-113343a037e3`.
+
+If the provided information is not enough to identify a visualization to adjust its parameters, you can configure {kib} logs to provide a human-readable description and a link to a source of the request:
+[source,yml]
+----
+logging:
+  loggers:
+    - name: execution_context
+      level: debug
+      appenders: [console]
+----
+Now, you can see the request to {es} has been initiated by the `[Logs] Unique Visitor Heatmap` visualization embedded in the `[Logs] Web Traffic` dashboard. You can navigate to the provided URL to change some parameters of the visualization.
+
+[source,text]
+----
+[DEBUG][execution_context] stored the execution context: {
+  "parent": {
+    "type": "application",
+    "name": "dashboard",
+    "id": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b",
+    "description": "[Logs] Web Traffic","url":"/view/edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b"
+  },
+  "type": "visualization",
+  "name": "Vega",
+  "id": "cb099a20-ea66-11eb-9425-113343a037e3",
+  "description": "[Logs] Unique Visitor Heatmap",
+  "url": "/app/visualize#/edit/cb099a20-ea66-11eb-9425-113343a037e3"
+}
+----

docs/user/troubleshooting/using-server-logs.asciidoc

@@ -1,6 +1,4 @@
-[[kibana-troubleshooting]]
-== Troubleshooting
-
+[[kibana-troubleshooting-kibana-server-logs]]
 === Using {kib} server logs
 {kib} Logs is a great way to see what's going on in your application and to debug performance issues. Navigating through a large number of generated logs can be overwhelming, and following are some techniques that you can use to optimize the process.