Add setting to enable frozen index search (#27297)

* Add setting to enable frozen index search

* Add description to docs

* Fix method calls

docs/management/advanced-options.asciidoc

@@ -39,6 +39,8 @@ document.
 `discover:sort:defaultOrder`:: Controls the default sort direction for time based index patterns in the Discover app.
 `doc_table:highlight`:: Highlight results in Discover and Saved Searches Dashboard. Highlighting makes request slow when
 working on big documents. Set this property to `false` to disable highlighting.
+`search:includeFrozen`:: Will include {ref}/frozen-indices.html[frozen indices] in results if enabled. Searching through frozen indices
+might increase the search time.
 `courier:maxSegmentCount`:: Kibana splits requests in the Discover app into segments to limit the size of requests sent to
 the Elasticsearch cluster. This setting constrains the length of the segment list. Long segment lists can significantly
 increase request processing time.

src/legacy/core_plugins/kibana/ui_setting_defaults.js

@@ -361,6 +361,14 @@ export function getUiSettingDefaults() {
       }),
       category: ['search'],
     },
+    'search:includeFrozen': {
+      name: 'Search in frozen indices',
+      description: `Will include <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/frozen-indices.html"
+        target="_blank" rel="noopener noreferrer">frozen indices</a> in results if enabled. Searching through frozen indices
+        might increase the search time.`,
+      value: false,
+      category: ['search'],
+    },
     'fields:popularLimit': {
       name: i18n.translate('kbn.advancedSettings.fieldsPopularLimitTitle', {
         defaultMessage: 'Popular fields limit',

src/legacy/core_plugins/metrics/server/lib/vis_data/get_annotations.js

@@ -50,7 +50,9 @@ export default async (req, panel) => {
 
   if (!bodies.length) return { responses: [] };
   try {
+    const includeFrozen = await req.getUiSettingsService().get('search:includeFrozen');
     const resp = await callWithRequest(req, 'msearch', {
+      ignore_throttled: !includeFrozen,
       rest_total_hits_as_int: true,
       body: bodies.reduce((acc, item) => acc.concat(item), [])
     });

src/legacy/core_plugins/metrics/server/lib/vis_data/get_series_data.js

@@ -21,11 +21,13 @@ import getRequestParams from './series/get_request_params';
 import handleResponseBody from './series/handle_response_body';
 import handleErrorResponse from './handle_error_response';
 import getAnnotations from './get_annotations';
-export function getSeriesData(req, panel) {
+export async function getSeriesData(req, panel) {
   const { callWithRequest } = req.server.plugins.elasticsearch.getCluster('data');
+  const includeFrozen = await req.getUiSettingsService().get('search:includeFrozen');
   const bodies = panel.series.map(series => getRequestParams(req, panel, series));
   const params = {
     rest_total_hits_as_int: true,
+    ignore_throttled: !includeFrozen,
     body: bodies.reduce((acc, items) => acc.concat(items), [])
   };
   return callWithRequest(req, 'msearch', params)

src/legacy/core_plugins/metrics/server/lib/vis_data/get_table_data.js

@@ -23,8 +23,10 @@ import { get } from 'lodash';
 import processBucket from './table/process_bucket';
 export async function getTableData(req, panel) {
   const { callWithRequest } = req.server.plugins.elasticsearch.getCluster('data');
+  const includeFrozen = await req.getUiSettingsService().get('search:includeFrozen');
   const params = {
     index: panel.index_pattern,
+    ignore_throttled: !includeFrozen,
     body: buildRequestBody(req, panel)
   };
   try {

src/legacy/core_plugins/timelion/server/series_functions/__tests__/es.js

@@ -198,7 +198,6 @@ describe(filename, () => {
     });
 
     describe('timeouts', () => {
-
       let sandbox;
 
       beforeEach(() => {
@@ -225,6 +224,34 @@ describe(filename, () => {
       });
     });
 
+    describe('frozen indices', () => {
+      let sandbox;
+
+      beforeEach(() => {
+        sandbox = sinon.createSandbox();
+      });
+
+      afterEach(() => {
+        sandbox.restore();
+      });
+
+      it('sets ignore_throttled=true on the request', () => {
+        config.index = 'beer';
+        tlConfig.settings['search:includeFrozen'] = false;
+        const request = fn(config, tlConfig, emptyScriptedFields);
+
+        expect(request.ignore_throttled).to.equal(true);
+      });
+
+      it('sets no timeout if elasticsearch.shardTimeout is set to 0', () => {
+        tlConfig.settings['search:includeFrozen'] = true;
+        config.index = 'beer';
+        const request = fn(config, tlConfig, emptyScriptedFields);
+
+        expect(request.ignore_throttled).to.equal(false);
+      });
+    });
+
     describe('query body', () => {
       beforeEach(() => {
         tlConfig = _.merge(tlConfigFn(), {

src/legacy/core_plugins/timelion/server/series_functions/es/lib/build_request.js

@@ -68,6 +68,7 @@ export default function buildRequest(config, tlConfig, scriptedFields) {
 
   const request = {
     index: config.index,
+    ignore_throttled: !tlConfig.settings['search:includeFrozen'],
     body: {
       query: {
         bool: bool

src/ui/public/courier/fetch/call_client.js

@@ -36,6 +36,7 @@ export function CallClientProvider(Private, Promise, es, config) {
 
   function callClient(searchRequests) {
     const maxConcurrentShardRequests = config.get('courier:maxConcurrentShardRequests');
+    const includeFrozen = config.get('search:includeFrozen');
 
     // merging docs can change status to DUPLICATE, capture new statuses
     const searchRequestsAndStatuses = mergeDuplicateRequests(searchRequests);
@@ -143,7 +144,7 @@ export function CallClientProvider(Private, Promise, es, config) {
           searching,
           abort,
           failedSearchRequests,
-        } = await searchStrategy.search({ searchRequests, es, Promise, serializeFetchParams, maxConcurrentShardRequests });
+        } = await searchStrategy.search({ searchRequests, es, Promise, serializeFetchParams, includeFrozen, maxConcurrentShardRequests });
 
         // Collect searchRequests which have successfully been sent.
         searchRequests.forEach(searchRequest => {

src/ui/public/courier/search_strategy/default_search_strategy.js

@@ -57,7 +57,7 @@ async function serializeAllFetchParams(fetchParams, searchRequests, serializeFet
 export const defaultSearchStrategy = {
   id: 'default',
 
-  search: async ({ searchRequests, es, Promise, serializeFetchParams, maxConcurrentShardRequests = 0 }) => {
+  search: async ({ searchRequests, es, Promise, serializeFetchParams, includeFrozen = false, maxConcurrentShardRequests = 0 }) => {
     // Flatten the searchSource within each searchRequest to get the fetch params,
     // e.g. body, filters, index pattern, query.
     const allFetchParams = await getAllFetchParams(searchRequests, Promise);
@@ -70,6 +70,8 @@ export const defaultSearchStrategy = {
 
     const msearchParams = {
       rest_total_hits_as_int: true,
+      // If we want to include frozen indexes we need to specify ignore_throttled: false
+      ignore_throttled: !includeFrozen,
       body: serializedFetchParams,
     };
 

src/ui/public/courier/search_strategy/default_search_strategy.test.js

@@ -55,6 +55,11 @@ describe('defaultSearchStrategy', function () {
       expect(searchArgs.es.msearch.mock.calls[0][0]).toHaveProperty('rest_total_hits_as_int', true);
     });
 
+    test('should set ignore_throttled=false when including frozen indices', async () => {
+      await search({ ...searchArgs, includeFrozen: true });
+      expect(searchArgs.es.msearch.mock.calls[0][0]).toHaveProperty('ignore_throttled', false);
+    });
+
   });
 
 });

x-pack/plugins/graph/server/lib/es/call_es_search_api.js

@@ -6,12 +6,12 @@
 
 import Boom from 'boom';
 
-export async function callEsSearchApi({ callCluster, index, body }) {
+export async function callEsSearchApi({ callCluster, index, body, queryParams }) {
   try {
     return {
       ok: true,
       resp: await callCluster('search', {
-        rest_total_hits_as_int: true,
+        ...queryParams,
         index,
         body
       })

x-pack/plugins/graph/server/routes/search_proxy.js

@@ -27,11 +27,16 @@ export const searchProxyRoute = {
         body: Joi.object().unknown(true).default()
       }).default()
     },
-    handler(request) {
-      return callEsSearchApi({
+    async handler(request) {
+      const includeFrozen = await request.getUiSettingsService().get('search:includeFrozen');
+      return await callEsSearchApi({
         callCluster: request.pre.callCluster,
         index: request.payload.index,
-        body: request.payload.body
+        body: request.payload.body,
+        queryParams: {
+          rest_total_hits_as_int: true,
+          ignore_throttled: !includeFrozen,
+        }
       });
     }
   }