[eem] _search endpoint / initial entity manager UI (#199609)

## Summary

- create `_search` endpoint to discover entities with esql queries. It
currently reads sources of the provided `type` from
`kibana_entity_definitions` index. Run this query to insert a
definition:
```
POST kibana_entity_definitions/_doc
{
    "entity_type": "service",
    "index_patterns": ["remote_cluster:logs-*"],
    "metadata_fields": [],
    "identity_fields": ["service.name"],
    "filters": [],
    "timestamp_field": "@timestamp"
}
```

By default `_search` will look at data in the last 5m. The lookup period
can be overriden by providing `start`/`end` parameters in ISO format. It
also accepts a `limit` to specify the number of entities returned which
defaults to 10

```
POST kbn:/internal/entities/v2/_search
{
    "type": "service",
    "start": "2024-11-19T20:40:00.000Z",
    "end": "2024-11-19T20:50:00.000Z",
    "limit": 20
}
```

- create `_search/preview` endpoint to preview output of entity sources
without persisting them
 
- create UI to preview results of an entity definition at
`/app/entity_manager`. The application is living in its own plugin at
`observability_solution/entity_manager_app`
![Screenshot 2024-11-11 at 11 37
18](https://github.com/user-attachments/assets/f284342d-21a3-4ba1-be94-38cff311266c)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Milton Hultgren <miltonhultgren@gmail.com>
This commit is contained in:
Kevin Lacabane 2024-11-22 16:12:04 +01:00 committed by GitHub
parent c3c872c6da
commit 0b3f4fbd3c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
35 changed files with 1482 additions and 14 deletions

View file

@ -579,6 +579,10 @@ security and spaces filtering.
|This plugin provides access to observed entity data, such as information about hosts, pods, containers, services, and more.
|{kib-repo}blob/{branch}/x-pack/plugins/observability_solution/entity_manager_app/README.md[entityManagerApp]
|This plugin provides a user interface to interact with the Entity Manager.
|{kib-repo}blob/{branch}/x-pack/plugins/event_log/README.md[eventLog]
|The event log plugin provides a persistent history of alerting and action
activities.