Introduces new @kbn/ecs package (#147408)

.github/CODEOWNERS

@@ -907,6 +907,7 @@ packages/kbn-dev-utils @elastic/kibana-operations
 packages/kbn-doc-links @elastic/kibana-docs
 packages/kbn-docs-utils @elastic/kibana-operations
 packages/kbn-ebt-tools @elastic/kibana-core
+packages/kbn-ecs @elastic/kibana-core
 packages/kbn-es @elastic/kibana-operations
 packages/kbn-es-archiver @elastic/kibana-operations
 packages/kbn-es-errors @elastic/kibana-core

package.json

@@ -328,6 +328,7 @@
     "@kbn/datemath": "link:bazel-bin/packages/kbn-datemath",
     "@kbn/doc-links": "link:bazel-bin/packages/kbn-doc-links",
     "@kbn/ebt-tools": "link:bazel-bin/packages/kbn-ebt-tools",
+    "@kbn/ecs": "link:bazel-bin/packages/kbn-ecs",
     "@kbn/es-errors": "link:bazel-bin/packages/kbn-es-errors",
     "@kbn/es-query": "link:bazel-bin/packages/kbn-es-query",
     "@kbn/es-types": "link:bazel-bin/packages/kbn-es-types",

packages/BUILD.bazel

@@ -227,6 +227,7 @@ filegroup(
     "//packages/kbn-doc-links:build",
     "//packages/kbn-docs-utils:build",
     "//packages/kbn-ebt-tools:build",
+    "//packages/kbn-ecs:build",
     "//packages/kbn-es:build",
     "//packages/kbn-es-archiver:build",
     "//packages/kbn-es-errors:build",
@@ -597,6 +598,7 @@ filegroup(
     "//packages/kbn-doc-links:build_types",
     "//packages/kbn-docs-utils:build_types",
     "//packages/kbn-ebt-tools:build_types",
+    "//packages/kbn-ecs:build_types",
     "//packages/kbn-es-archiver:build_types",
     "//packages/kbn-es-errors:build_types",
     "//packages/kbn-es-query:build_types",

packages/core/logging/core-logging-server-internal/BUILD.bazel

@@ -55,6 +55,7 @@ TYPES_DEPS = [
   "@npm//chalk",
   "//packages/kbn-safer-lodash-set:npm_module_types",
   "//packages/kbn-logging:npm_module_types",
+  "//packages/kbn-ecs:npm_module_types",
   "//packages/kbn-config-schema:npm_module_types",
   "//packages/core/base/core-base-server-internal:npm_module_types",
   "//packages/core/logging/core-logging-common-internal:npm_module_types",

packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts

@@ -9,7 +9,8 @@
 import moment from 'moment-timezone';
 import { merge } from '@kbn/std';
 import { schema } from '@kbn/config-schema';
-import { Ecs, LogRecord, Layout } from '@kbn/logging';
+import { Ecs } from '@kbn/ecs';
+import { LogRecord, Layout } from '@kbn/logging';
 
 const { literal, object } = schema;
 

packages/core/saved-objects/core-saved-objects-server/BUILD.bazel

@@ -44,6 +44,7 @@ TYPES_DEPS = [
   "//packages/kbn-utility-types:npm_module_types",
   "//packages/kbn-config-schema:npm_module_types",
   "//packages/kbn-logging:npm_module_types",
+  "//packages/kbn-ecs:npm_module_types",
   "//packages/core/http/core-http-server:npm_module_types",
   "//packages/core/elasticsearch/core-elasticsearch-server:npm_module_types",
   "//packages/core/saved-objects/core-saved-objects-common:npm_module_types",

packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts

@@ -7,7 +7,7 @@
  */
 
 import type { SavedObject } from '@kbn/core-saved-objects-common';
-import type { EcsEventOutcome } from '@kbn/logging';
+import type { EcsEventOutcome } from '@kbn/ecs';
 
 /**
  * The CheckAuthorizationParams interface contains settings for checking

packages/kbn-ecs/BUILD.bazel

@@ -0,0 +1,104 @@
+load("@npm//@bazel/typescript:index.bzl", "ts_config")
+load("@build_bazel_rules_nodejs//:index.bzl", "js_library")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler", "pkg_npm", "pkg_npm_types", "ts_project")
+
+PKG_DIRNAME = "kbn-ecs"
+PKG_REQUIRE_NAME = "@kbn/ecs"
+
+SOURCE_FILES = glob(
+  [
+    "**/*.ts",
+  ],
+  exclude = [
+    "**/*.config.js",
+    "**/*.mock.*",
+    "**/*.test.*",
+    "**/*.stories.*",
+    "**/__snapshots__/**",
+    "**/integration_tests/**",
+    "**/mocks/**",
+    "**/scripts/**",
+    "**/storybook/**",
+    "**/test_fixtures/**",
+    "**/test_helpers/**",
+  ],
+)
+
+SRCS = SOURCE_FILES
+
+filegroup(
+  name = "srcs",
+  srcs = SRCS,
+)
+
+NPM_MODULE_EXTRA_FILES = [
+  "package.json",
+]
+
+RUNTIME_DEPS = []
+
+TYPES_DEPS = [
+  "@npm//@types/node",
+  "@npm//@types/jest"
+]
+
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
+
+ts_config(
+  name = "tsconfig",
+  src = "tsconfig.json",
+  deps = [
+    "//:tsconfig.base.json",
+    "//:tsconfig.bazel.json",
+  ],
+)
+
+ts_project(
+  name = "tsc_types",
+  args = ['--pretty'],
+  srcs = SRCS,
+  deps = TYPES_DEPS,
+  declaration = True,
+  emit_declaration_only = True,
+  out_dir = "target_types",
+  tsconfig = ":tsconfig",
+)
+
+js_library(
+  name = PKG_DIRNAME,
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+js_library(
+  name = "npm_module_types",
+  srcs = NPM_MODULE_EXTRA_FILES,
+  deps = RUNTIME_DEPS + [":target_node", ":tsc_types"],
+  package_name = PKG_REQUIRE_NAME,
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "npm_module",
+  deps = [":" + PKG_DIRNAME],
+)
+
+filegroup(
+  name = "build",
+  srcs = [
+    ":npm_module",
+  ],
+  visibility = ["//visibility:public"],
+)
+
+pkg_npm(
+  name = "build_types",
+  deps = [":npm_module_types"],
+  visibility = ["//visibility:public"],
+)

packages/kbn-ecs/README.md

@@ -0,0 +1,5 @@
+# @kbn/ecs
+
+Base types for Elastic common schema. These types are used for `logging` and any extensions to the types declared in this package need to be in their own dedicated packages.
+
+https://www.elastic.co/guide/en/ecs/current/index.html

packages/kbn-ecs/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './src/ecs';

packages/kbn-ecs/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-ecs'],
+};

packages/kbn-ecs/kibana.jsonc

@@ -0,0 +1,7 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/ecs",
+  "owner": "@elastic/kibana-core",
+  "runtimeDeps": [],
+  "typeDeps": [],
+}

packages/kbn-ecs/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@kbn/ecs",
+  "version": "1.0.0",
+  "private": true,
+  "author": "Kibana Core",
+  "license": "SSPL-1.0 OR Elastic License 2.0",
+  "main": "./target_node/index.js",
+  "types": "./target_types/index.d.ts"
+}

packages/kbn-ecs/src/ecs/index.ts

@@ -45,6 +45,45 @@ import { EcsUser } from './user';
 import { EcsUserAgent } from './user_agent';
 import { EcsVulnerability } from './vulnerability';
 
+export type {
+  EcsAgent,
+  EcsAutonomousSystem,
+  EcsBase,
+  EcsClient,
+  EcsCloud,
+  EcsContainer,
+  EcsDataStream,
+  EcsDestination,
+  EcsDns,
+  EcsEmail,
+  EcsError,
+  EcsFaas,
+  EcsFile,
+  EcsGroup,
+  EcsHost,
+  EcsHttp,
+  EcsLog,
+  EcsNetwork,
+  EcsObserver,
+  EcsOrchestrator,
+  EcsOrganization,
+  EcsPackage,
+  EcsProcess,
+  EcsRegistry,
+  EcsRelated,
+  EcsRule,
+  EcsServer,
+  EcsService,
+  EcsSource,
+  EcsThreat,
+  EcsTls,
+  EcsTracing,
+  EcsUrl,
+  EcsUser,
+  EcsUserAgent,
+  EcsVulnerability,
+};
+
 export type {
   EcsEvent,
   EcsEventCategory,

packages/kbn-ecs/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.bazel.json",
+  "compilerOptions": {
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "target_types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ]
+}

packages/kbn-logging/BUILD.bazel

@@ -37,13 +37,15 @@ NPM_MODULE_EXTRA_FILES = [
 ]
 
 RUNTIME_DEPS = [
-  "//packages/kbn-std"
+  "//packages/kbn-std",
+  "//packages/kbn-ecs"
 ]
 
 TYPES_DEPS = [
   "//packages/kbn-std:npm_module_types",
   "@npm//@types/jest",
   "@npm//@types/node",
+ "//packages/kbn-ecs:npm_module_types"
 ]
 
 jsts_transpiler(

packages/kbn-logging/index.ts

@@ -14,11 +14,3 @@ export type { LogMeta } from './src/log_meta';
 export type { LoggerFactory } from './src/logger_factory';
 export type { Layout } from './src/layout';
 export type { Appender, DisposableAppender } from './src/appenders';
-export type {
-  Ecs,
-  EcsEvent,
-  EcsEventCategory,
-  EcsEventKind,
-  EcsEventOutcome,
-  EcsEventType,
-} from './src/ecs';

packages/kbn-logging/src/log_meta.ts

@@ -6,40 +6,41 @@
  * Side Public License, v 1.
  */
 
-import { EcsBase } from './ecs/base';
-
-import { EcsAgent } from './ecs/agent';
-import { EcsAutonomousSystem } from './ecs/autonomous_system';
-import { EcsClient } from './ecs/client';
-import { EcsCloud } from './ecs/cloud';
-import { EcsContainer } from './ecs/container';
-import { EcsDestination } from './ecs/destination';
-import { EcsDns } from './ecs/dns';
-import { EcsError } from './ecs/error';
-import { EcsEvent } from './ecs/event';
-import { EcsFile } from './ecs/file';
-import { EcsGroup } from './ecs/group';
-import { EcsHost } from './ecs/host';
-import { EcsHttp } from './ecs/http';
-import { EcsLog } from './ecs/log';
-import { EcsNetwork } from './ecs/network';
-import { EcsObserver } from './ecs/observer';
-import { EcsOrganization } from './ecs/organization';
-import { EcsPackage } from './ecs/package';
-import { EcsProcess } from './ecs/process';
-import { EcsRegistry } from './ecs/registry';
-import { EcsRelated } from './ecs/related';
-import { EcsRule } from './ecs/rule';
-import { EcsServer } from './ecs/server';
-import { EcsService } from './ecs/service';
-import { EcsSource } from './ecs/source';
-import { EcsThreat } from './ecs/threat';
-import { EcsTls } from './ecs/tls';
-import { EcsTracing } from './ecs/tracing';
-import { EcsUrl } from './ecs/url';
-import { EcsUser } from './ecs/user';
-import { EcsUserAgent } from './ecs/user_agent';
-import { EcsVulnerability } from './ecs/vulnerability';
+import {
+  EcsBase,
+  EcsAgent,
+  EcsAutonomousSystem,
+  EcsClient,
+  EcsCloud,
+  EcsContainer,
+  EcsDestination,
+  EcsDns,
+  EcsError,
+  EcsEvent,
+  EcsFile,
+  EcsGroup,
+  EcsHost,
+  EcsHttp,
+  EcsLog,
+  EcsNetwork,
+  EcsObserver,
+  EcsOrganization,
+  EcsPackage,
+  EcsProcess,
+  EcsRegistry,
+  EcsRelated,
+  EcsRule,
+  EcsServer,
+  EcsService,
+  EcsSource,
+  EcsThreat,
+  EcsTls,
+  EcsTracing,
+  EcsUrl,
+  EcsUser,
+  EcsUserAgent,
+  EcsVulnerability,
+} from '@kbn/ecs';
 
 /**
  * Represents the ECS schema with the following reserved keys excluded:

src/core/server/index.ts

@@ -212,18 +212,8 @@ export type {
   LoggerConfigType,
   AppenderConfigType,
 } from '@kbn/core-logging-server';
-export type {
-  Logger,
-  LoggerFactory,
-  Ecs,
-  EcsEventCategory,
-  EcsEventKind,
-  EcsEventOutcome,
-  EcsEventType,
-  LogMeta,
-  LogRecord,
-  LogLevel,
-} from '@kbn/logging';
+export type { Logger, LoggerFactory, LogMeta, LogRecord, LogLevel } from '@kbn/logging';
+export type { Ecs, EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from '@kbn/ecs';
 
 export type { NodeInfo, NodeRoles } from '@kbn/core-node-server';
 

src/plugins/files/server/audit_events.ts

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { EcsEventOutcome } from '@kbn/logging';
+import { EcsEventOutcome } from '@kbn/ecs';
 import { AuditEvent } from '@kbn/security-plugin/server';
 
 export type AuditAction = 'create' | 'delete';

tsconfig.base.json

@@ -442,6 +442,8 @@
       "@kbn/docs-utils/*": ["packages/kbn-docs-utils/*"],
       "@kbn/ebt-tools": ["packages/kbn-ebt-tools"],
       "@kbn/ebt-tools/*": ["packages/kbn-ebt-tools/*"],
+      "@kbn/ecs": ["packages/kbn-ecs"],
+      "@kbn/ecs/*": ["packages/kbn-ecs/*"],
       "@kbn/es": ["packages/kbn-es"],
       "@kbn/es/*": ["packages/kbn-es/*"],
       "@kbn/es-archiver": ["packages/kbn-es-archiver"],

x-pack/plugins/cases/server/services/user_actions/audit_logger.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { EcsEventType } from '@kbn/logging';
+import type { EcsEventType } from '@kbn/ecs';
 import type { AuditLogger } from '@kbn/security-plugin/server';
 import type { UserAction as Action } from '../../../common/api';
 import type { EventDetails } from './types';

x-pack/plugins/cloud_security_posture/common/schemas/csp_finding.ts

@@ -6,7 +6,7 @@
  */
 
 // TODO: this needs to be defined in a versioned schema
-import type { EcsEvent } from '@kbn/logging';
+import type { EcsEvent } from '@kbn/ecs';
 import type { CspRuleMetadata } from './csp_rule_metadata';
 
 export interface CspFinding {

x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.test.tsx

@@ -11,7 +11,7 @@ import * as TEST_SUBJECTS from '../test_subjects';
 import { FindingsTable } from './latest_findings_table';
 import type { PropsOf } from '@elastic/eui';
 import Chance from 'chance';
-import type { EcsEvent } from '@kbn/logging';
+import type { EcsEvent } from '@kbn/ecs';
 import { TestProvider } from '../../../test/test_provider';
 import { CspFinding } from '../../../../common/schemas/csp_finding';
 

yarn.lock

@@ -3565,6 +3565,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/ecs@link:bazel-bin/packages/kbn-ecs":
+  version "0.0.0"
+  uid ""
+
 "@kbn/es-archiver@link:bazel-bin/packages/kbn-es-archiver":
   version "0.0.0"
   uid ""