github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[7.2] [DOCS] Removed below references (#60159) (#60329)

Browse source 
* [DOCS] Removed below references (#60159)

* Fixed build error
This commit is contained in:
Kaarina Tungseth 2020-03-17 13:49:37 -05:00 • committed by GitHub
parent dac54d5acc
commit f156d6907b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
25 changed files with 836 additions and 255 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/apm/advanced-queries.asciidoc
View file

@ -2,12 +2,12 @@
=== Advanced queries
When querying, you're simply searching and selecting data from fields in Elasticsearch documents.
It may be helpful to view some of your documents in {kibana-ref}/discover.html[Discover] to better understand how APM data is stored in Elasticsearch.
It may be helpful to view some of your documents in {kibana-ref}/discover.html[Discover] to better understand how APM data is stored in Elasticsearch.
Queries entered into the query bar are also added as parameters to the URL,
so it's easy to share a specific query or view with others.
In the screenshot below, you can begin to see some of the transaction fields available for filtering on:
You can begin to see some of the transaction fields available for filtering:
[role="screenshot"]
image::apm/images/apm-query-bar.png[Example of the Kibana Query bar in APM UI in Kibana]

6
docs/apm/spans.asciidoc
View file

@ -12,12 +12,12 @@ This makes it useful for visualizing where the selected transaction spent most o
image::apm/images/apm-distributed-tracing.png[Example view of the distributed tracing in APM UI in Kibana]
View a span in detail by clicking on it in the timeline waterfall.
For example, in the below screenshot we've clicked on an SQL Select database query.
The information displayed includes the actual SQL that was executed, how long it took,
When you click on an SQL Select database query,
the information displayed includes the actual SQL that was executed, how long it took,
and the percentage of the trace's total time.
You also get a stack trace, which shows the SQL query in your code.
Finally, APM knows which files are your code and which are just modules or libraries that you've installed.
These library frames will be minimized by default in order to show you the most relevant stack trace.
These library frames will be minimized by default in order to show you the most relevant stack trace.
[role="screenshot"]
image::apm/images/apm-span-detail.png[Example view of a span detail in the APM UI in Kibana]

10
docs/apm/transactions.asciidoc
View file

@ -34,7 +34,7 @@ The transaction overview will only display helpful information when the transact
Elastic APM Agents come with built-in support for popular frameworks out-of-the-box.
However, if you only see one route in the Transaction overview page, or if you have transactions named "unknown route",
it could be a symptom that the agent either wasn't installed correctly or doesn't support your framework.
it could be a symptom that the agent either wasn't installed correctly or doesn't support your framework.
For further details, including troubleshooting and custom implementation instructions,
refer to the documentation for each {apm-agents-ref}[APM Agent] you've implemented.
@ -46,7 +46,7 @@ refer to the documentation for each {apm-agents-ref}[APM Agent] you've implement
Selecting a transaction group will bring you to the *transaction* details.
Transaction details include a high-level overview of the transaction group duration,
requests per minute, and transaction group duration distribution.
It's important to note that all three of these graphs show data from every transaction within the selected transaction group.
It's important to note that all three of these graphs show data from every transaction within the selected transaction group.
[role="screenshot"]
image::apm/images/apm-transaction-response-dist.png[Example view of response time distribution]
@ -59,9 +59,7 @@ The number of requests per bucket is displayed when hovering over the graph, and
[role="screenshot"]
image::apm/images/apm-transaction-duration-dist.png[Example view of transactions duration distribution graph]
Let's look at an example.
In the screenshot below,
you'll notice most of our requests fall into buckets on the left side of the graph,
Most of the requests fall into buckets on the left side of the graph,
with a long tail of smaller buckets to the right.
This is a typical distribution, and indicates most of our requests were served quickly - awesome!
It's the requests on the right, the ones taking longer than average, that we probably want to focus on.
@ -88,4 +86,4 @@ For a particular transaction sample, we can get even more information in the *me
* Custom - You can configure your agent to add custom contextual information on transactions.
TIP: All of this data is stored in documents in Elasticsearch.
This means you can select "Actions - View sample document" to see the actual Elasticsearch document under the discover tab.
This means you can select "Actions - View sample document" to see the actual Elasticsearch document under the discover tab.

207
docs/canvas/canvas-tinymath-functions.asciidoc
View file

@ -3,21 +3,21 @@
=== TinyMath functions
TinyMath provides a set of functions that can be used with the Canvas expression
language to perform complex math calculations. Read on for detailed information about
the functions available in TinyMath, including what parameters each function accepts,
language to perform complex math calculations. Read on for detailed information about
the functions available in TinyMath, including what parameters each function accepts,
the return value of that function, and examples of how each function behaves.
Most of the functions below accept arrays and apply JavaScript Math methods to
each element of that array. For the functions that accept multiple arrays as
parameters, the function generally does the calculation index by index.
Most of the functions accept arrays and apply JavaScript Math methods to
each element of that array. For the functions that accept multiple arrays as
parameters, the function generally does the calculation index by index.
Any function below can be wrapped by another function as long as the return type
Any function can be wrapped by another function as long as the return type
of the inner function matches the acceptable parameter type of the outer function.
[float]
=== abs( a )
Calculates the absolute value of a number. For arrays, the function will be
Calculates the absolute value of a number. For arrays, the function will be
applied index-wise to each element.
[cols="3*^<"]
@ -29,7 +29,7 @@ applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The absolute value of `a`. Returns
*Returns*: `number` | `Array.<number>`. The absolute value of `a`. Returns
an array with the absolute values of each element if `a` is an array.
*Example*
@ -43,7 +43,7 @@ abs([-1 , -2, 3, -4]) // returns [1, 2, 3, 4]
[float]
=== add( ...args )
Calculates the sum of one or more numbers/arrays passed into the function. If at
Calculates the sum of one or more numbers/arrays passed into the function. If at
least one array of numbers is passed into the function, the function will calculate the sum by index.
[cols="3*^<"]
@ -55,9 +55,9 @@ least one array of numbers is passed into the function, the function will calcul
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The sum of all numbers in `args` if `args`
contains only numbers. Returns an array of sums of the elements at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
*Returns*: `number` | `Array.<number>`. The sum of all numbers in `args` if `args`
contains only numbers. Returns an array of sums of the elements at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
contains at least one array.
*Throws*: `'Array length mismatch'` if `args` contains arrays of different lengths
@ -73,7 +73,7 @@ add([1, 2], 3, [4, 5], 6) // returns [(1 + 3 + 4 + 6), (2 + 3 + 5 + 6)] = [14, 1
[float]
=== cbrt( a )
Calculates the cube root of a number. For arrays, the function will be applied
Calculates the cube root of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -85,7 +85,7 @@ index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The cube root of `a`. Returns an array with
*Returns*: `number` | `Array.<number>`. The cube root of `a`. Returns an array with
the cube roots of each element if `a` is an array.
*Example*
@ -99,7 +99,7 @@ cbrt([27, 64, 125]) // returns [3, 4, 5]
[float]
=== ceil( a )
Calculates the ceiling of a number, i.e., rounds a number towards positive infinity.
Calculates the ceiling of a number, i.e., rounds a number towards positive infinity.
For arrays, the function will be applied index-wise to each element.
[cols="3*^<"]
@ -111,7 +111,7 @@ For arrays, the function will be applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The ceiling of `a`. Returns an array with
*Returns*: `number` | `Array.<number>`. The ceiling of `a`. Returns an array with
the ceilings of each element if `a` is an array.
*Example*
@ -125,7 +125,7 @@ ceil([1.1, 2.2, 3.3]) // returns [2, 3, 4]
[float]
=== clamp( ...a, min, max )
Restricts value to a given range and returns closed available value. If only `min`
Restricts value to a given range and returns closed available value. If only `min`
is provided, values are restricted to only a lower bound.
[cols="3*^<"]
@ -145,11 +145,11 @@ is provided, values are restricted to only a lower bound.
|(optional) The maximum value this function will return.
|===
*Returns*: `number` | `Array.<number>`. The closest value between `min` (inclusive)
and `max` (inclusive). Returns an array with values greater than or equal to `min`
*Returns*: `number` | `Array.<number>`. The closest value between `min` (inclusive)
and `max` (inclusive). Returns an array with values greater than or equal to `min`
and less than or equal to `max` (if provided) at each index.
*Throws*:
*Throws*:
- `'Array length mismatch'` if a `min` and/or `max` are arrays of different lengths
@ -194,7 +194,7 @@ count(100) // returns 1
[float]
=== cube( a )
Calculates the cube of a number. For arrays, the function will be applied
Calculates the cube of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -206,7 +206,7 @@ index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The cube of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The cube of `a`. Returns an array
with the cubes of each element if `a` is an array.
*Example*
@ -219,7 +219,7 @@ cube([3, 4, 5]) // returns [27, 64, 125]
[float]
=== divide( a, b )
Divides two numbers. If at least one array of numbers is passed into the function,
Divides two numbers. If at least one array of numbers is passed into the function,
the function will be applied index-wise to each element.
[cols="3*^<"]
@ -235,8 +235,8 @@ the function will be applied index-wise to each element.
|divisor, a number or an array of numbers, b != 0
|===
*Returns*: `number` | `Array.<number>`. Returns the quotient of `a` and `b`
if both are numbers. Returns an array with the quotients applied index-wise to
*Returns*: `number` | `Array.<number>`. Returns the quotient of `a` and `b`
if both are numbers. Returns an array with the quotients applied index-wise to
each element if `a` or `b` is an array.
*Throws*:
@ -257,7 +257,7 @@ divide([14, 42, 65, 108], [2, 7, 5, 12]) // returns [7, 6, 13, 9]
[float]
=== exp( a )
Calculates _e^x_ where _e_ is Euler's number. For arrays, the function will be applied
Calculates _e^x_ where _e_ is Euler's number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -269,7 +269,7 @@ index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. Returns an array with the values of
*Returns*: `number` | `Array.<number>`. Returns an array with the values of
`e^x` evaluated where `x` is each element of `a` if `a` is an array.
*Example*
@ -282,7 +282,7 @@ exp([1, 2, 3]) // returns [e^1, e^2, e^3] = [2.718281828459045, 7.38905609893064
[float]
=== first( a )
Returns the first element of an array. If anything other than an array is passed
Returns the first element of an array. If anything other than an array is passed
in, the input is returned.
[cols="3*^<"]
@ -306,7 +306,7 @@ first([1, 2, 3]) // returns 1
[float]
=== fix( a )
Calculates the fix of a number, i.e., rounds a number towards 0. For arrays, the
Calculates the fix of a number, i.e., rounds a number towards 0. For arrays, the
function will be applied index-wise to each element.
[cols="3*^<"]
@ -318,7 +318,7 @@ function will be applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The fix of `a`. Returns an array with
*Returns*: `number` | `Array.<number>`. The fix of `a`. Returns an array with
the fixes for each element if `a` is an array.
*Example*
@ -332,7 +332,7 @@ fix([1.8, 2.9, -3.7, -4.6]) // returns [1, 2, -3, -4]
[float]
=== floor( a )
Calculates the floor of a number, i.e., rounds a number towards negative infinity.
Calculates the floor of a number, i.e., rounds a number towards negative infinity.
For arrays, the function will be applied index-wise to each element.
[cols="3*^<"]
@ -344,7 +344,7 @@ For arrays, the function will be applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The floor of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The floor of `a`. Returns an array
with the floor of each element if `a` is an array.
*Example*
@ -358,7 +358,7 @@ floor([1.7, 2.8, 3.9]) // returns [1, 2, 3]
[float]
=== last( a )
Returns the last element of an array. If anything other than an array is passed
Returns the last element of an array. If anything other than an array is passed
in, the input is returned.
[cols="3*^<"]
@ -382,7 +382,7 @@ last([1, 2, 3]) // returns 3
[float]
=== log( a, b )
Calculates the logarithm of a number. For arrays, the function will be applied
Calculates the logarithm of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -398,7 +398,7 @@ index-wise to each element.
|(optional) base for the logarithm. If not provided a value, the default base is e, and the natural log is calculated.
|===
*Returns*: `number` | `Array.<number>`. The logarithm of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The logarithm of `a`. Returns an array
with the the logarithms of each element if `a` is an array.
*Throws*:
@ -419,7 +419,7 @@ log([2, 4, 8, 16, 32], 2) // returns [1, 2, 3, 4, 5]
[float]
=== log10( a )
Calculates the logarithm base 10 of a number. For arrays, the function will be
Calculates the logarithm base 10 of a number. For arrays, the function will be
applied index-wise to each element.
[cols="3*^<"]
@ -431,7 +431,7 @@ applied index-wise to each element.
|a number or an array of numbers, `a` must be greater than 0
|===
*Returns*: `number` | `Array.<number>`. The logarithm of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The logarithm of `a`. Returns an array
with the the logarithms base 10 of each element if `a` is an array.
*Throws*: `'Must be greater than 0'` if `a` < 0
@ -448,8 +448,8 @@ log([10, 100, 1000, 10000, 100000]) // returns [1, 2, 3, 4, 5]
[float]
=== max( ...args )
Finds the maximum value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the maximum value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the maximum by index.
[cols="3*^<"]
@ -461,9 +461,9 @@ find the maximum by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The maximum value of all numbers if
`args` contains only numbers. Returns an array with the the maximum values at each
index, including all scalar numbers in `args` in the calculation at each index if
*Returns*: `number` | `Array.<number>`. The maximum value of all numbers if
`args` contains only numbers. Returns an array with the the maximum values at each
index, including all scalar numbers in `args` in the calculation at each index if
`args` contains at least one array.
*Throws*: `'Array length mismatch'` if `args` contains arrays of different lengths
@ -479,8 +479,8 @@ max([1, 9], 4, [3, 5]) // returns [max([1, 4, 3]), max([9, 4, 5])] = [4, 9]
[float]
=== mean( ...args )
Finds the mean value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the mean value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the mean by index.
[cols="3*^<"]
@ -492,9 +492,9 @@ find the mean by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The maximum value of all numbers if
`args` contains only numbers. Returns an array with the the maximum values at each
index, including all scalar numbers in `args` in the calculation at each index if
*Returns*: `number` | `Array.<number>`. The maximum value of all numbers if
`args` contains only numbers. Returns an array with the the maximum values at each
index, including all scalar numbers in `args` in the calculation at each index if
`args` contains at least one array.
*Throws*: `'Array length mismatch'` if `args` contains arrays of different lengths
@ -510,8 +510,8 @@ max([1, 9], 4, [3, 5]) // returns [max([1, 4, 3]), max([9, 4, 5])] = [4, 9]
[float]
=== mean( ...args )
Finds the mean value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the mean value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the mean by index.
[cols="3*^<"]
@ -523,9 +523,9 @@ find the mean by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The mean value of all numbers if `args`
contains only numbers. Returns an array with the the mean values of each index,
including all scalar numbers in `args` in the calculation at each index if `args`
*Returns*: `number` | `Array.<number>`. The mean value of all numbers if `args`
contains only numbers. Returns an array with the the mean values of each index,
including all scalar numbers in `args` in the calculation at each index if `args`
contains at least one array.
*Example*
@ -539,8 +539,8 @@ mean([1, 9], 5, [3, 4]) // returns [mean([1, 5, 3]), mean([9, 5, 4])] = [3, 6]
[float]
=== median( ...args )
Finds the median value(s) of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the median value(s) of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the median by index.
[cols="3*^<"]
@ -552,9 +552,9 @@ find the median by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The median value of all numbers if `args`
contains only numbers. Returns an array with the the median values of each index,
including all scalar numbers in `args` in the calculation at each index if `args`
*Returns*: `number` | `Array.<number>`. The median value of all numbers if `args`
contains only numbers. Returns an array with the the median values of each index,
including all scalar numbers in `args` in the calculation at each index if `args`
contains at least one array.
*Example*
@ -569,8 +569,8 @@ median([1, 9], 2, 4, [3, 5]) // returns [median([1, 2, 4, 3]), median([9, 2, 4,
[float]
=== min( ...args )
Finds the minimum value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the minimum value of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the minimum by index.
[cols="3*^<"]
@ -582,9 +582,9 @@ find the minimum by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The minimum value of all numbers if
`args` contains only numbers. Returns an array with the the minimum values of each
index, including all scalar numbers in `args` in the calculation at each index if `a`
*Returns*: `number` | `Array.<number>`. The minimum value of all numbers if
`args` contains only numbers. Returns an array with the the minimum values of each
index, including all scalar numbers in `args` in the calculation at each index if `a`
is an array.
*Throws*: `'Array length mismatch'` if `args` contains arrays of different lengths.
@ -600,7 +600,7 @@ min([1, 9], 4, [3, 5]) // returns [min([1, 4, 3]), min([9, 4, 5])] = [1, 4]
[float]
=== mod( a, b )
Remainder after dividing two numbers. If at least one array of numbers is passed
Remainder after dividing two numbers. If at least one array of numbers is passed
into the function, the function will be applied index-wise to each element.
[cols="3*^<"]
@ -616,8 +616,8 @@ into the function, the function will be applied index-wise to each element.
|divisor, a number or an array of numbers, b != 0
|===
*Returns*: `number` | `Array.<number>`. The remainder of `a` divided by `b` if
both are numbers. Returns an array with the the remainders applied index-wise to
*Returns*: `number` | `Array.<number>`. The remainder of `a` divided by `b` if
both are numbers. Returns an array with the the remainders applied index-wise to
each element if `a` or `b` is an array.
*Throws*:
@ -638,8 +638,8 @@ mod([14, 42, 65, 108], [5, 4, 14, 2]) // returns [5, 2, 9, 0]
[float]
=== mode( ...args )
Finds the mode value(s) of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
Finds the mode value(s) of one of more numbers/arrays of numbers passed into the function.
If at least one array of numbers is passed into the function, the function will
find the mode by index.
[cols="3*^<"]
@ -651,9 +651,9 @@ find the mode by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<Array.<number>>`. An array of mode value(s) of all
numbers if `args` contains only numbers. Returns an array of arrays with mode value(s)
of each index, including all scalar numbers in `args` in the calculation at each index
*Returns*: `number` | `Array.<Array.<number>>`. An array of mode value(s) of all
numbers if `args` contains only numbers. Returns an array of arrays with mode value(s)
of each index, including all scalar numbers in `args` in the calculation at each index
if `args` contains at least one array.
*Example*
@ -668,7 +668,7 @@ mode([1, 9], 1, 4, [3, 5]) // returns [mode([1, 1, 4, 3]), mode([9, 1, 4, 5])] =
[float]
=== multiply( a, b )
Multiplies two numbers. If at least one array of numbers is passed into the function,
Multiplies two numbers. If at least one array of numbers is passed into the function,
the function will be applied index-wise to each element.
[cols="3*^<"]
@ -684,11 +684,11 @@ the function will be applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The product of `a` and `b` if both are
numbers. Returns an array with the the products applied index-wise to each element
*Returns*: `number` | `Array.<number>`. The product of `a` and `b` if both are
numbers. Returns an array with the the products applied index-wise to each element
if `a` or `b` is an array.
*Throws*: `'Array length mismatch'` if `a` and `b` are arrays with different lengths
*Throws*: `'Array length mismatch'` if `a` and `b` are arrays with different lengths
*Example*
[source, js]
@ -702,7 +702,7 @@ multiply([1, 2, 3, 4], [2, 7, 5, 12]) // returns [2, 14, 15, 48]
[float]
=== pow( a, b )
Calculates the cube root of a number. For arrays, the function will be applied
Calculates the cube root of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -718,7 +718,7 @@ index-wise to each element.
|the power that `a` is raised to
|===
*Returns*: `number` | `Array.<number>`. `a` raised to the power of `b`. Returns
*Returns*: `number` | `Array.<number>`. `a` raised to the power of `b`. Returns
an array with the each element raised to the power of `b` if `a` is an array.
*Throws*: `'Missing exponent'` if `b` is not provided
@ -733,8 +733,8 @@ pow([1, 2, 3], 4) // returns [1, 16, 81]
[float]
=== random( a, b )
Generates a random number within the given range where the lower bound is inclusive
and the upper bound is exclusive. If no numbers are passed in, it will return a
Generates a random number within the given range where the lower bound is inclusive
and the upper bound is exclusive. If no numbers are passed in, it will return a
number between 0 and 1. If only one number is passed in, it will return a number
between 0 and the number passed in.
@ -751,11 +751,11 @@ between 0 and the number passed in.
|(optional) must be greater than `a`
|===
*Returns*: `number`. A random number between 0 and 1 if no numbers are passed in.
Returns a random number between 0 and `a` if only one number is passed in. Returns
*Returns*: `number`. A random number between 0 and 1 if no numbers are passed in.
Returns a random number between 0 and `a` if only one number is passed in. Returns
a random number between `a` and `b` if two numbers are passed in.
*Throws*: `'Min must be greater than max'` if `a` < 0 when only `a` is passed in
*Throws*: `'Min must be greater than max'` if `a` < 0 when only `a` is passed in
or if `a` > `b` when both `a` and `b` are passed in
*Example*
@ -769,8 +769,8 @@ random(-10,10) // returns a random number between -10 (inclusive) and 10 (exclus
[float]
=== range( ...args )
Finds the range of one of more numbers/arrays of numbers passed into the function. If at
least one array of numbers is passed into the function, the function will find
Finds the range of one of more numbers/arrays of numbers passed into the function. If at
least one array of numbers is passed into the function, the function will find
the range by index.
[cols="3*^<"]
@ -782,9 +782,9 @@ the range by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The range value of all numbers if `args`
contains only numbers. Returns an array with the range values at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
*Returns*: `number` | `Array.<number>`. The range value of all numbers if `args`
contains only numbers. Returns an array with the range values at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
contains at least one array.
*Example*
@ -798,8 +798,8 @@ range([1, 9], 4, [3, 5]) // returns [range([1, 4, 3]), range([9, 4, 5])] = [3, 5
[float]
=== range( ...args )
Finds the range of one of more numbers/arrays of numbers into the function. If at
least one array of numbers is passed into the function, the function will find
Finds the range of one of more numbers/arrays of numbers into the function. If at
least one array of numbers is passed into the function, the function will find
the range by index.
[cols="3*^<"]
@ -811,9 +811,9 @@ the range by index.
|one or more numbers or arrays of numbers
|===
*Returns*: `number` | `Array.<number>`. The range value of all numbers if `args`
contains only numbers. Returns an array with the the range values at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
*Returns*: `number` | `Array.<number>`. The range value of all numbers if `args`
contains only numbers. Returns an array with the the range values at each index,
including all scalar numbers in `args` in the calculation at each index if `args`
contains at least one array.
*Example*
@ -827,7 +827,7 @@ range([1, 9], 4, [3, 5]) // returns [range([1, 4, 3]), range([9, 4, 5])] = [3, 5
[float]
=== round( a, b )
Rounds a number towards the nearest integer by default, or decimal place (if passed in as `b`).
Rounds a number towards the nearest integer by default, or decimal place (if passed in as `b`).
For arrays, the function will be applied index-wise to each element.
[cols="3*^<"]
@ -843,7 +843,7 @@ For arrays, the function will be applied index-wise to each element.
|(optional) number of decimal places, default value: 0
|===
*Returns*: `number` | `Array.<number>`. The rounded value of `a`. Returns an
*Returns*: `number` | `Array.<number>`. The rounded value of `a`. Returns an
array with the the rounded values of each element if `a` is an array.
*Example*
@ -885,7 +885,7 @@ size(100) // returns 1
[float]
=== sqrt( a )
Calculates the square root of a number. For arrays, the function will be applied
Calculates the square root of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -897,7 +897,7 @@ index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The square root of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The square root of `a`. Returns an array
with the the square roots of each element if `a` is an array.
*Throws*: `'Unable find the square root of a negative number'` if `a` < 0
@ -913,7 +913,7 @@ sqrt([9, 16, 25]) // returns [3, 4, 5]
[float]
=== square( a )
Calculates the square of a number. For arrays, the function will be applied
Calculates the square of a number. For arrays, the function will be applied
index-wise to each element.
[cols="3*^<"]
@ -925,7 +925,7 @@ index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The square of `a`. Returns an array
*Returns*: `number` | `Array.<number>`. The square of `a`. Returns an array
with the the squares of each element if `a` is an array.
*Example*
@ -938,7 +938,7 @@ square([3, 4, 5]) // returns [9, 16, 25]
[float]
=== subtract( a, b )
Subtracts two numbers. If at least one array of numbers is passed into the function,
Subtracts two numbers. If at least one array of numbers is passed into the function,
the function will be applied index-wise to each element.
[cols="3*^<"]
@ -954,7 +954,7 @@ the function will be applied index-wise to each element.
|a number or an array of numbers
|===
*Returns*: `number` | `Array.<number>`. The difference of `a` and `b` if both are
*Returns*: `number` | `Array.<number>`. The difference of `a` and `b` if both are
numbers, or an array of differences applied index-wise to each element.
*Throws*: `'Array length mismatch'` if `a` and `b` are arrays with different lengths
@ -971,11 +971,11 @@ subtract([14, 42, 65, 108], [2, 7, 5, 12]) // returns [12, 35, 52, 96]
[float]
=== sum( ...args )
Calculates the sum of one or more numbers/arrays passed into the function. If at
least one array is passed, the function will sum up one or more numbers/arrays of
Calculates the sum of one or more numbers/arrays passed into the function. If at
least one array is passed, the function will sum up one or more numbers/arrays of
numbers and distinct values of an array. Sum accepts arrays of different lengths.
*Returns*: `number`. The sum of one or more numbers/arrays of numbers including
*Returns*: `number`. The sum of one or more numbers/arrays of numbers including
distinct values in arrays
*Example*
@ -992,7 +992,7 @@ sum([10, 20, 30, 40], 10, [1, 2, 3], 22) // returns sum(10, 20, 30, 40, 10, 1, 2
Counts the number of unique values in an array.
*Returns*: `number`. The number of unique values in the array. Returns 1 if `a`
*Returns*: `number`. The number of unique values in the array. Returns 1 if `a`
is not an array.
*Example*
@ -1003,4 +1003,3 @@ unique([]) // returns 0
unique([1, 2, 3, 4]) // returns 4
unique([1, 2, 3, 4, 2, 2, 2, 3, 4, 2, 4, 5, 2, 1, 4, 2]) // returns 5
------------

8
docs/dev-tools/searchprofiler/more-complicated.asciidoc
View file

@ -25,11 +25,11 @@ POST test/_bulk
// CONSOLE
--
. From the {searchprofiler}, enter "test" in the Index field above the query editor to restrict profiled
. From the {searchprofiler}, enter "test" in the *Index* field to restrict profiled
queries to the `test` index.
. Replace the default `match_all` query in the query editor with a query that has two sub-query
components and includes a simple aggregation, like the example below.
components and includes a simple aggregation:
+
--
[source,js]
@ -66,7 +66,7 @@ components and includes a simple aggregation, like the example below.
// NOTCONSOLE
--
. Click *Profile* to profile the query and visualize the results.
. Click *Profile* to profile the query and visualize the results.
. Select the shard to view the query details.
+
[role="screenshot"]
@ -100,5 +100,5 @@ Select the name of the shard to view the aggregation details and timing breakdow
image::dev-tools/searchprofiler/images/gs10.png["Drilling into the first shard's details"]
For more information about how the {searchprofiler} works, how timings are calculated, and
how to interpret various results, see
how to interpret various results, see
{ref}/search-profile-queries.html[Profiling queries].

4
docs/developer/core/development-functional-tests.asciidoc
View file

@ -69,7 +69,7 @@ node scripts/functional_tests_server.js
node ../scripts/functional_test_runner.js
----------
** Selenium tests are run in headless mode on CI. Locally the same tests will be executed in a real browser. You can activate headless mode by setting the environment variable below:
** Selenium tests are run in headless mode on CI. Locally the same tests will be executed in a real browser. You can activate headless mode by setting the environment variable:
+
["source", "shell"]
----------
@ -180,7 +180,7 @@ node scripts/functional_test_runner --config test/functional/config.firefox.js
[float]
===== Anatomy of a test file
The annotated example file below shows the basic structure every test suite uses. It starts by importing https://github.com/elastic/kibana/tree/master/packages/kbn-expect[`@kbn/expect`] and defining its default export: an anonymous Test Provider. The test provider then destructures the Provider API for the `getService()` and `getPageObjects()` functions. It uses these functions to collect the dependencies of this suite. The rest of the test file will look pretty normal to mocha.js users. `describe()`, `it()`, `before()` and the lot are used to define suites that happen to automate a browser via services and objects of type `PageObject`.
This annotated example file shows the basic structure every test suite uses. It starts by importing https://github.com/elastic/kibana/tree/master/packages/kbn-expect[`@kbn/expect`] and defining its default export: an anonymous Test Provider. The test provider then destructures the Provider API for the `getService()` and `getPageObjects()` functions. It uses these functions to collect the dependencies of this suite. The rest of the test file will look pretty normal to mocha.js users. `describe()`, `it()`, `before()` and the lot are used to define suites that happen to automate a browser via services and objects of type `PageObject`.
["source","js"]
----

8
docs/developer/plugin/development-plugin-feature-registration.asciidoc
View file

@ -45,8 +45,8 @@ Registering a feature consists of the following fields. For more information, co
|An array of applications this feature enables. Typically, all of your plugin's apps (from `uiExports`) will be included here.
|`privileges` (required)
|{repo}blob/{branch}/x-pack/plugins/xpack_main/server/lib/feature_registry/feature_registry.ts[`FeatureWithAllOrReadPrivileges`].
|see examples below
|{repo}blob/{branch}/x-pack/plugins/features/server/feature.ts[`FeatureWithAllOrReadPrivileges`].
|See <<example-1-canvas,Example 1>> and <<example-2-dev-tools,Example 2>>
|The set of privileges this feature requires to function.
|`icon`
@ -80,6 +80,7 @@ if (canUserSave) {
}
-----------
[[example-1-canvas]]
==== Example 1: Canvas Application
["source","javascript"]
-----------
@ -113,7 +114,7 @@ init(server) {
-----------
This shows how the Canvas application might register itself as a Kibana feature.
Note that it specifies different `savedObject` access levels for each privilege:
Note that it specifies different `savedObject` access levels for each privilege:
- Users with read/write access (`all` privilege) need to be able to read/write `canvas-workpad` saved objects, and they need read-only access to `index-pattern` saved objects.
- Users with read-only access (`read` privilege) do not need to have read/write access to any saved objects, but instead get read-only access to `index-pattern` and `canvas-workpad` saved objects.
@ -134,6 +135,7 @@ if (canUserSave) {
Because the `read` privilege does not define the `save` capability, users with read-only access will have their `uiCapabilities.canvas.save` flag set to `false`.
[[example-2-dev-tools]]
==== Example 2: Dev Tools
["source","javascript"]

2
docs/developer/plugin/development-plugin-localization.asciidoc
View file

@ -161,7 +161,7 @@ Full details are {repo}tree/master/packages/kbn-i18n#angularjs[here].
To learn more about i18n tooling, see {blob}src/dev/i18n/README.md[i18n dev tooling].
To learn more about implementing i18n in the UI, follow the links below:
To learn more about implementing i18n in the UI, use the following links:
* {blob}packages/kbn-i18n/README.md[i18n plugin]
* {blob}packages/kbn-i18n/GUIDELINE.md[i18n guidelines]

17
docs/discover/kuery.asciidoc
View file

@ -2,13 +2,13 @@
=== Kibana Query Language
In Kibana 6.3, we introduced a number of exciting experimental query language enhancements. These
features are now available by default in 7.0. Out of the box, Kibana's query language now includes scripted field support and a
simplified, easier to use syntax. If you have a Basic license or above, autocomplete functionality will also be enabled.
features are now available by default in 7.0. Out of the box, Kibana's query language now includes scripted field support and a
simplified, easier to use syntax. If you have a Basic license or above, autocomplete functionality will also be enabled.
==== Language Syntax
If you're familiar with Kibana's old lucene query syntax, you should feel right at home with the new syntax. The basics
stay the same, we've simply refined things to make the query language easier to use. Read about the changes below.
If you're familiar with Kibana's old Lucene query syntax, you should feel right at home with the new syntax. The basics
stay the same, we've simply refined things to make the query language easier to use.
`response:200` will match documents where the response field matches the value 200.
@ -19,8 +19,8 @@ they appear. This means documents with "quick brown fox" will match, but so will
to search for a phrase.
The query parser will no longer split on whitespace. Multiple search terms must be separated by explicit
boolean operators. Lucene will combine search terms with an `or` by default, so `response:200 extension:php` would
become `response:200 or extension:php` in KQL. This will match documents where response matches 200, extension matches php, or both.
boolean operators. Lucene will combine search terms with an `or` by default, so `response:200 extension:php` would
become `response:200 or extension:php` in KQL. This will match documents where response matches 200, extension matches php, or both.
Note that boolean operators are not case sensitive.
We can make terms required by using `and`.
@ -48,9 +48,9 @@ Entire groups can also be inverted.
`response:200 and not (extension:php or extension:css)`
Ranges are similar to lucene with a small syntactical difference.
Ranges are similar to lucene with a small syntactical difference.
Instead of `bytes:>1000`, we omit the colon: `bytes > 1000`.
Instead of `bytes:>1000`, we omit the colon: `bytes > 1000`.
`>, >=, <, <=` are all valid range operators.
@ -71,4 +71,3 @@ Terms without fields will be matched against the default field in your index set
set these terms will be matched against all fields. For example, a query for `response:200` will search for the value 200
in the response field, but a query for just `200` will search for 200 across all fields in your index.
============

35
docs/discover/search.asciidoc
View file

@ -53,7 +53,6 @@ docs.
NOTE: These examples use the Lucene query syntax. When lucene is selected as your
query language you can also submit queries using the {ref}/query-dsl.html[Elasticsearch Query DSL].
[[save-open-search]]
=== Saving and Opening Searches
Saving searches enables you to reload them into Discover and use them as the basis
@ -87,37 +86,3 @@ To load a saved search into Discover:
If the saved search is associated with a different index pattern than is currently
selected, opening the saved search changes the selected index pattern. The query language
used for the saved search will also be automatically selected.
[[select-pattern]]
=== Changing Which Indices You're Searching
When you submit a search request, the indices that match the currently-selected
index pattern are searched. The current index pattern is shown below the toolbar.
To change which indices you are searching, click the index pattern and select a
different index pattern.
For more information about index patterns, see <<settings-create-pattern,
Creating an Index Pattern>>.
[[autorefresh]]
=== Refreshing the Search Results
As more documents are added to the indices you're searching, the search results
shown in Discover and used to display visualizations get stale. You can
configure a refresh interval to periodically resubmit your searches to
retrieve the latest results.
To enable auto refresh:
. Click the *Time Picker* image:images/time-picker.jpg[Time Picker] in the
Kibana toolbar.
. Click *Auto refresh*.
. Choose a refresh interval from the list.
+
image::images/autorefresh-intervals.png[]
When auto refresh is enabled, the refresh interval is displayed next to the
Time Picker, along with a Pause button. To temporarily disable auto refresh,
click *Pause*.
NOTE: If auto refresh is not enabled, you can manually refresh visualizations
by clicking *Refresh*.

144
docs/epm/index.asciidoc Normal file
View file

@ -0,0 +1,144 @@
[role="xpack"]
[[epm]]
== Elastic Package Manager
These are the docs for the Elastic Package Manager (EPM).
=== Configuration
The Elastic Package Manager by default access `epr.elastic.co` to retrieve the package. The url can be configured with:
```
xpack.epm.registryUrl: 'http://localhost:8080'
```
=== API
The Package Manager offers an API. Here an example on how they can be used.
List installed packages:
```
curl localhost:5601/api/ingest_manager/epm/packages
```
Install a package:
```
curl -X POST localhost:5601/api/ingest_manager/epm/packages/iptables-1.0.4
```
Delete a package:
```
curl -X DELETE localhost:5601/api/ingest_manager/epm/packages/iptables-1.0.4
```
=== Definitions
This section is to define terms used across ingest management.
==== Elastic Agent
A single, unified agent that users can deploy to hosts or containers. It controls which data is collected from the host or containers and where the data is sent. It will run Beats, Endpoint or other monitoring programs as needed. It can operate standalone or pull a configuration policy from Fleet.
==== Namespace
A user-specified string that will be used to part of the index name in Elasticsearch. It helps users identify logs coming from a specific environment (like prod or test), an application, or other identifiers.
==== Package
A package contains all the assets for the Elastic Stack. A more detailed definition of a package can be found under https://github.com/elastic/package-registry.
== Indexing Strategy
Ingest Management enforces an indexing strategy to allow the system to automatically detect indices and run queries on it. In short the indexing strategy looks as following:
```
{type}-{dataset}-{namespace}
```
The `{type}` can be `logs` or `metrics`. The `{namespace}` is the part where the user can use free form. The only two requirement are that it has only characters allowed in an Elasticsearch index name and does NOT contain a `-`. The `dataset` is defined by the data that is indexed. The same requirements as for the namespace apply. It is expected that the fields for type, namespace and dataset are part of each event and are constant keywords.
Note: More `{type}`s might be added in the future like `apm` and `endpoint`.
This indexing strategy has a few advantages:
* Each index contains only the fields which are relevant for the dataset. This leads to more dense indices and better field completion.
* ILM policies can be applied per namespace per dataset.
* Rollups can be specified per namespace per dataset.
* Having the namespace user configurable makes setting security permissions possible.
* Having a global metrics and logs template, allows to create new indices on demand which still follow the convention. This is common in the case of k8s as an example.
* Constant keywords allow to narrow down the indices we need to access for querying very efficiently. This is especially relevant in environments which a large number of indices or with indices on slower nodes.
=== Ingest Pipeline
The ingest pipelines for a specific dataset will have the following naming scheme:
```
{type}-{dataset}-{package.version}
```
As an example, the ingest pipeline for the Nginx access logs is called `logs-nginx.access-3.4.1`. The same ingest pipeline is used for all namespaces. It is possible that a dataset has multiple ingest pipelines in which case a suffix is added to the name.
The version is included in each pipeline to allow upgrades. The pipeline itself is listed in the index template and is automatically applied at ingest time.
=== Templates & ILM Policies
To make the above strategy possible, alias templates are required. For each type there is a basic alias template with a default ILM policy. These default templates apply to all indices which follow the indexing strategy and do not have a more specific dataset alias template.
The `metrics` and `logs` alias template contain all the basic fields from ECS.
Each type template contains an ILM policy. Modifying this default ILM policy will affect all data covered by the default templates.
The templates for a dataset are called as following:
```
{type}-{dataset}
```
The pattern used inside the index template is `{type}-{dataset}-*` to match all namespaces.
=== Defaults
If the Elastic Agent is used to ingest data and only the type is specified, `default` for the namespace is used and `generic` for the dataset.
=== Data filtering
Filtering for data in queries for example in visualizations or dashboards should always be done on the constant keyword fields. Visualizations needing data for the nginx.access dataset should query on `type:logs AND dataset:nginx.access`. As these are constant keywords the prefiltering is very efficient.
=== Security permissions
Security permissions can be set on different levels. To set special permissions for the access on the prod namespace, use the following index pattern:
```
/(logs|metrics)-[^-]+-prod-$/
```
To set specific permissions on the logs index, the following can be used:
```
/^(logs|metrics)-.*/
```
Todo: The above queries need to be tested.
== Package Manager
=== Package Upgrades
When upgrading a package between a bugfix or a minor version, no breaking changes should happen. Upgrading a package has the following effect:
* Removal of existing dashboards
* Installation of new dashboards
* Write new ingest pipelines with the version
* Write new Elasticsearch alias templates
* Trigger a rollover for all the affected indices
The new ingest pipeline is expected to still work with the data coming from older configurations. In most cases this means some of the fields can be missing. For this to work, each event must contain the version of config / package it is coming from to make such a decision.
In case of a breaking change in the data structure, the new ingest pipeline is also expected to deal with this change. In case there are breaking changes which cannot be dealt with in an ingest pipeline, a new package has to be created.
Each package lists its minimal required agent version. In case there are agents enrolled with an older version, the user is notified to upgrade these agents as otherwise the new configs cannot be rolled out.

182
docs/management/numeral.asciidoc Normal file
View file

@ -0,0 +1,182 @@
[[numeral]]
== Numeral Formatting
Numeral formatting in {kib} is done through a pattern-based syntax.
These patterns express common number formats in a concise way, similar
to date formatting. While these patterns are originally based on Numeral.js,
they are now maintained by {kib}.
Numeral formatting patterns are used in multiple places in {kib}, including:
* <<advanced-options, Advanced settings>>
* <<field-formatters-numeric, Index pattern formatters>>
* <<TSVB, TSVB>>
* <<canvas, Canvas>>
The simplest pattern format is `0`, and the default {kib} pattern is `0,0.[000]`.
The numeral pattern syntax expresses:
Number of decimal places:: The `.` character turns on the option to show decimal
places using a locale-specific decimal separator, most often `.` or `,`.
To add trailing zeroes such as `5.00`, use a pattern like `0.00`.
To have optional zeroes, use the `[]` characters.
Thousands separator:: The thousands separator `,` turns on the option to group
thousands using a locale-specific separator. The separator is most often `,` or `.`,
and sometimes ` `.
Accounting notation:: Putting parentheses around your format like `(0.00)` will use accounting notation to show negative numbers.
The display of these patterns is affected by the <<kibana-general-settings, advanced setting>> `format:number:defaultLocale`.
The default locale is `en`, but some examples will specify that they are using an alternate locale.
Most basic examples:
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 10000.23 | 0,0 | en (English) | 10,000
| 10000.23 | 0.0 | en (English) | 10000.2
| 10000.23 | 0,0.0 | fr (French) | 10 000,2
| 10000.23 | 0,0.000 | fr (French) | 10 000,230
| 10000.23 | 0,0[.]0 | en (English) | 10,000.2
| 10000.23 | 0.00[0] | en (English) | 10,000.23
| -10000.23 | (0) | en (English) | (10000)
|===
[float]
=== Percentages
By adding the `%` symbol to any of the previous patterns, the value
is multiplied by 100 and the `%` symbol is added in the place indicated.
The default percentage formatter in {kib} is `0,0.[000]%`, which shows
up to three decimal places.
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 0.43 | 0,0.[000]% | en (English) | 43.00%
| 0.43 | 0,0.[000]% | fr (French) | 43,00%
| 1 | 0% | en (English) | 100%
| -0.43 | 0 % | en (English) | -43 %
|===
[float]
=== Bytes and bits
The bytes and bits formatters will shorten the input by adding a suffix like `GB` or `TB`. Bytes and bits formatters include the following suffixes:
`b`:: Bytes with binary values and suffixes. 1024 = `1KB`
`bb`:: Bytes with binary values and binary suffixes. 1024 = `1KiB`
`bd`:: Bytes with decimal values and suffixes. 1000 = `1kB`
`bitb`:: Bits with binary values and suffixes. 1024 = `1Kibit`
`bitd`:: Bits with decimal values and suffixes. 1000 = `1kbit`
Suffixes are not localized with this formatter.
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 2000 | 0.00b | en (English) | 1.95KB
| 2000 | 0.00bb | en (English) | 1.95KiB
| 2000 | 0.00bd | en (English) | 2.00kB
| 3153654400000 | 0.00bd | en (English) | 3.15GB
| 2000 | 0.00bitb | en (English) | 1.95Kibit
| 2000 | 0.00bitd | en (English) | 2.00kbit
|===
[float]
=== Currency
Currency formatting is limited in {kib} due to the limitations of the pattern
syntax. To enable currency formatting, use the symbol `$` in the pattern syntax.
The number formatting locale will affect the result.
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 1000.234 | $0,0.00 | en (English) | $1,000.23
| 1000.234 | $0,0.00 | fr (French) | €1 000,23
| 1000.234 | $0,0.00 | chs (Simplified Chinese) | ¥1,000.23
|===
[float]
=== Duration formatting
Converts a value in seconds to display hours, minutes, and seconds.
|===
| **Input** | **Pattern** | **Output**
| 25 | 00:00:00 | 0:00:25
| 25 | 00:00 | 0:00:25
| 238 | 00:00:00 | 0:03:58
| 63846 | 00:00:00 | 17:44:06
| -1 | 00:00:00 | -0:00:01
|===
[float]
=== Displaying abbreviated numbers
The `a` pattern will look for the shortest abbreviation for your
number, and use a locale-specific display for it. The abbreviations
`aK`, `aM`, `aB`, and `aT` can indicate that the number should be
abbreviated to a specific order of magnitude.
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 2000000000 | 0.00a | en (English) | 2.00b
| 2000000000 | 0.00a | ja (Japanese) | 2.00十億
| -5444333222111 | 0,0 aK | en (English) | -5,444,333,222 k
| -5444333222111 | 0,0 aM | en (English) | -5,444,333 m
| -5444333222111 | 0,0 aB | en (English) | -5,444 b
| -5444333222111 | 0,0 aT | en (English) | -5 t
|===
[float]
=== Ordinal numbers
The `o` pattern will display a locale-specific positional value like `1st` or `2nd`.
This pattern has limited support for localization, especially in languages
with multiple forms, such as German.
|===
| **Input** | **Pattern** | **Locale** | **Output**
| 3 | 0o | en (English) | 3rd
| 34 | 0o | en (English) | 34th
| 3 | 0o | es (Spanish) | 2er
| 3 | 0o | ru (Russian) | 3.
|===
[float]
=== Complete number pattern reference
These number formats, combined with the previously described patterns,
produce the complete set of options for numeral formatting.
The output here is all for the `en` locale.
|===
| **Input** | **Pattern** | **Output**
| 10000 | 0,0.0000 | 10,000.0000
| 10000.23 | 0,0 | 10,000
| -10000 | 0,0.0 | -10,000.0
| 10000.1234 | 0.000 | 10000.123
| 10000 | 0[.]00 | 10000
| 10000.1 | 0[.]00 | 10000.10
| 10000.123 | 0[.]00 | 10000.12
| 10000.456 | 0[.]00 | 10000.46
| 10000.001 | 0[.]00 | 10000
| 10000.45 | 0[.]00[0] | 10000.45
| 10000.456 | 0[.]00[0] | 10000.456
| -10000 | (0,0.0000) | (10,000.0000)
| -12300 | +0,0.0000 | -12,300.0000
| 1230 | +0,0 | +1,230
| 100.78 | 0 | 101
| 100.28 | 0 | 100
| 1.932 | 0.0 | 1.9
| 1.9687 | 0 | 2
| 1.9687 | 0.0 | 2.0
| -0.23 | .00 | -.23
| -0.23 | (.00) | (.23)
| 0.23 | 0.00000 | 0.23000
| 0.67 | 0.0[0000] | 0.67
| 1.005 | 0.00 | 1.01
| 1e35 | 000 | 1e+35
| -1e35 | 000 | -1e+35
| 1e-27 | 000 | 1e-27
| -1e-27 | 000 | -1e-27
|===

77
docs/management/rollups/create_and_manage_rollups.asciidoc
View file

@ -3,12 +3,12 @@
== Rollup jobs
A rollup job is a periodic task that aggregates data from indices specified
by an index pattern and rolls it into a new index. Rollup indices are a good way to
compactly store months or years of historical
A rollup job is a periodic task that aggregates data from indices specified
by an index pattern and rolls it into a new index. Rollup indices are a good way to
compactly store months or years of historical
data for use in visualizations and reports.
You’ll find *Rollup Jobs* under *Management > Elasticsearch*. With this UI,
You’ll find *Rollup Jobs* under *Management > Elasticsearch*. With this UI,
you can:
* <<create-and-manage-rollup-job, Create a rollup job>>
@ -17,22 +17,22 @@ you can:
[role="screenshot"]
image::images/management_rollup_list.png[][List of currently active rollup jobs]
Before using this feature, you should be familiar with how rollups work.
{ref}/xpack-rollup.html[Rolling up historical data] is a good source for more detailed information.
Before using this feature, you should be familiar with how rollups work.
{ref}/xpack-rollup.html[Rolling up historical data] is a good source for more detailed information.
[float]
[[create-and-manage-rollup-job]]
=== Create a rollup job
{kib} makes it easy for you to create a rollup job by walking you through
the process. You fill in the name, data flow, and how often you want to roll
up the data. Then you define a date histogram aggregation for the rollup job
and optionally terms, histogram, and metrics aggregations.
{kib} makes it easy for you to create a rollup job by walking you through
the process. You fill in the name, data flow, and how often you want to roll
up the data. Then you define a date histogram aggregation for the rollup job
and optionally terms, histogram, and metrics aggregations.
When defining the index pattern, you must enter a name that is different than
the output rollup index. Otherwise, the job
will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`,
you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`.
When defining the index pattern, you must enter a name that is different than
the output rollup index. Otherwise, the job
will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`,
you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`.
[role="screenshot"]
image::images/management_create_rollup_job.png[][Wizard that walks you through creation of a rollup job]
@ -41,39 +41,35 @@ image::images/management_create_rollup_job.png[][Wizard that walks you through c
[[manage-rollup-job]]
=== Start, stop, and delete rollup jobs
Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page,
where you can drill down for further investigation. The *Manage* menu in
Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page,
where you can drill down for further investigation. The *Manage* menu in
the lower right enables you to start, stop, and delete the rollup job.
You must first stop a rollup job before deleting it.
[role="screenshot"]
image::images/management_rollup_job_details.png[][Rollup job details]
You can’t change a rollup job after you’ve created it. To select additional fields
or redefine terms, you must delete the existing job, and then create a new one
with the updated specifications. Be sure to use a different name for the new rollup
job&mdash;reusing the same name can lead to problems with mismatched job configurations.
You can read more at {ref}/rollup-job-config.html[rollup job configuration].
You can’t change a rollup job after you’ve created it. To select additional fields
or redefine terms, you must delete the existing job, and then create a new one
with the updated specifications. Be sure to use a different name for the new rollup
job&mdash;reusing the same name can lead to problems with mismatched job configurations.
You can read more at {ref}/rollup-job-config.html[rollup job configuration].
[float]
=== Try it: Create and visualize rolled up data
This example creates a rollup job to capture log data from sample web logs.
This example creates a rollup job to capture log data from sample web logs.
To follow along, add the <<add-sample-data, sample web logs data set>>.
In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
to roll up once a day into the index `rollup_logstash`. You’ll bucket the
rolled up data on an hourly basis, using 60m for the time bucket configuration.
to roll up once a day into the index `rollup_logstash`. You’ll bucket the
rolled up data on an hourly basis, using 60m for the time bucket configuration.
This allows for more granular queries, such as 2h and 12h.
[float]
==== Create the rollup job
As you walk through the *Create rollup job* UI, enter the data shown in
the table below. The terms, histogram, and metrics fields reflect
the key information to retain in the rolled up data: where visitors are from (geo.src),
what operating system they are using (machine.os.keyword),
and how much data is being sent (bytes).
As you walk through the *Create rollup job* UI, enter the data:
|===
|*Field* |*Value*
@ -117,32 +113,33 @@ and how much data is being sent (bytes).
|bytes (average)
|===
The terms, histogram, and metrics fields reflect
the key information to retain in the rolled up data: where visitors are from (geo.src),
what operating system they are using (machine.os.keyword),
and how much data is being sent (bytes).
You can now use the rolled up data for analysis at a fraction of the storage cost
of the original index. The original data can live side by side with the new
You can now use the rolled up data for analysis at a fraction of the storage cost
of the original index. The original data can live side by side with the new
rollup index, or you can remove or archive it using <<creating-index-lifecycle-policies,Index Lifecycle Management>>.
[float]
==== Visualize the rolled up data
Your next step is to visualize your rolled up data in a vertical bar chart.
Your next step is to visualize your rolled up data in a vertical bar chart.
Most visualizations support rolled up data, with the exception of Timelion, TSVB, and Vega visualizations.
Using the information from the example rollup configuration described above,
you can use `rollup_logstash` to match the rolled up index pattern,
and `kibana_sample_data_logs` to match the index pattern for raw data.
The notation for a combination index pattern with both raw and rolled up data
Using the information from the example rollup configuration described above,
you can use `rollup_logstash` to match the rolled up index pattern,
and `kibana_sample_data_logs` to match the index pattern for raw data.
The notation for a combination index pattern with both raw and rolled up data
is `rollup_logstash,kibana_sample_data_logs`.
[role="screenshot"]
image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
You can then create a dashboard that contains visualizations of the rolled up
You can then create a dashboard that contains visualizations of the rolled up
data, raw data, or both. See <<visualize-rollup-data, Using rolled up data in a visualization>>
for more information.
[role="screenshot"]
image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]

43
docs/maps/geojson-upload.asciidoc Normal file
View file

@ -0,0 +1,43 @@
[role="xpack"]
[[geojson-upload]]
== Upload GeoJSON data
*Elastic Maps* makes it easy to import geospatial data into the Elastic Stack.
Using the *GeoJSON Upload* feature, you can drag and drop your point and shape
data files directly into {es}, and then use them as layers
in the map. You can also use the GeoJSON data in the broader Kibana ecosystem,
for example, in visualizations and Canvas workpads.
[float]
=== Why GeoJSON?
GeoJSON is an open-standard file format for storing geospatial vector data.
Although many vector data formats are available in the GIS community,
GeoJSON is the most commonly used and flexible option.
[float]
=== Upload a GeoJSON file
Follow these instructions to upload a GeoJSON data file, or try the
<<indexing-geojson-data-tutorial, end-to-end integrated example>>.
. Open *Elastic Maps*, and then click *Add layer*.
. Click *Uploaded GeoJSON*.
+
[role="screenshot"]
image::maps/images/fu_gs_select_source_file_upload.png[]
. Use the file chooser to select a valid GeoJSON file. The file will load
a preview of the data on the map.
. Use the default *Index type* of {ref}/geo-point.html[geo_point] for point data,
or override it and select {ref}/geo-shape.html[geo_shape].
All other shapes will default to a type of `geo_shape`.
. Leave the default *Index name* and *Index pattern* names (the name of the uploaded
file minus its extension). You might need to change the index name if it is invalid.
. Click *Import file*.
+
Upon completing the indexing process and creating the associated index pattern,
the Elasticsearch responses are shown on the *Layer add panel* and the indexed data
appears on the map. The geospatial data on the map
should be identical to the locally-previewed data, but now it's indexed data from Elasticsearch.
. To continue adding data to the map, click *Add layer* in the lower
right-hand corner.
. In *Layer settings*, adjust any settings or <<maps-vector-style-properties, properties>> as needed.
. Click *Save & close*.

137
docs/maps/indexing-geojson-data-tutorial.asciidoc Normal file
View file

@ -0,0 +1,137 @@
[role="xpack"]
[[indexing-geojson-data-tutorial]]
== Indexing GeoJSON data tutorial
In this tutorial, you'll build a customized map that shows the flight path between
two airports, and the lightning hot spots on that route. You'll learn to:
* Import GeoJSON files into Kibana
* Index the files in {es}
* Display the data in a multi-layer map
[float]
=== Before you begin
This tutorial requires you to download the following GeoJSON sample data files.
These files are good examples of the types
of vector data that you can upload to Kibana and index in
Elasticsearch for display in *Elastic Maps*.
* https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/logan_international_airport.geojson[Logan International Airport]
* https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/bangor_international_airport.geojson[Bangor International Airport]
* https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/lightning_detected.geojson[Lightning detected]
* https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/original_flight_path.geojson[Original flight path]
* https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/modified_flight_path.geojson[Modified flight path]
The data represents two real airports, two fictitious flight routes, and
fictitious lightning reports. You don't need to use all of
these files. Feel free to work with as many files as you'd like, or use valid GeoJSON
files of your own.
[float]
[role="xpack"]
=== Create and set up a map
. <<maps-create, Create a new map>>.
. Zoom in on the New England area in the northeast United States.
+
You're adding flight paths to this area, and this
sets up the map for a good view of the data.
+
[role="screenshot"]
image::maps/images/fu_gs_new_england_map.png[]
[float]
[[upload-and-index-geojson-file]]
=== Upload and index GeoJSON files
For each GeoJSON file you downloaded, complete the following steps:
. Click *Add layer*.
. From the list of layer types, click *Uploaded GeoJSON*.
. Using the File Picker, upload the GeoJSON file.
+
Depending on the geometry type of your features, this will
auto-populate *Index type* with either {ref}/geo-point.html[geo_point] or
{ref}/geo-shape.html[geo_shape] and *Index name* with
`<file name>`.
. Click *Import file* in the lower right.
+
You'll see activity as the GeoJSON Upload utility creates a new index
and index pattern for the data set. When the process is complete, you should
receive messages that the creation of the new index and index pattern
were successful.
. Click *Add layer* in the bottom right.
. In *Layer settings*, adjust settings and <<maps-vector-style-properties, properties>> as needed.
. Click *Save & close*.
. Once you've added all of the sample files,
<<maps-save, save your map>>.
+
At this point, you could consider the map complete,
but there are a few additions and tweaks that you can make to tell a
better story with your data.
+
[role="screenshot"]
image::maps/images/fu_gs_flight_paths.png[]
[float]
=== Add a heatmap aggregation layer
Looking at the `Lightning detected` layer, it's clear where lightning has
struck. What's less clear, is if there have been more lightning
strikes in some areas than others, in other words, where the lightning
hot spots are. An advantage of having indexed
{ref}/geo-point.html[geo_point] data for the
lightning strikes is that you can perform aggregations on the data.
. Click *Add layer*.
. From the list of layer types, click *Grid aggregation*.
+
Because you indexed `lightning_detected.geojson` using the index name and
pattern `lightning_detected`, that data is available as a {ref}/geo-point.html[geo_point]
aggregation.
. Select `lightning_detected`.
. Click *Show as* and select `heat map`.
. Click *Add layer* to add the heat map layer
"Lightning intensity".
+
The remaining default settings are good, but there are a couple of
settings that you might want to change.
. Play around with the *Layer Style* >
*Color range* setting.
+
Again the default looks good, but feel free to choose a
different color range.
. When you're finished modifying settings, click *Save & close*.
+
With your new lightning heat map layer, your map should look
like this:
+
[role="screenshot"]
image::maps/images/fu_gs_lightning_intensity.png[]
[float]
=== Organize the layers
Consider ways you might improve the appearance of the final map.
Small changes in how and when layers are shown can help tell a
better story with your data. Here are a few final tweaks
you might make:
* Update layer names
* Adjust styles for each layer
* Adjust the layer order
* Decide which layers to show at different zoom levels
When you've finished, again be sure to <<maps-save, save your work >>.
Your final map might look like this:
[role="screenshot"]
image::maps/images/fu_gs_final_map.png[]

8
docs/maps/vector-style.asciidoc
View file

@ -29,7 +29,7 @@ Set border color to style line geometries.
Use static styling to specificy a constant value for a style property.
The image below shows an example of static styling using the <<add-sample-data, Kibana sample web logs>> data set.
This image shows an example of static styling using the <<add-sample-data, Kibana sample web logs>> data set.
The *kibana_sample_data_logs* layer uses static styling for all properties.
[role="screenshot"]
@ -44,7 +44,7 @@ To enable data driven styling, click image:maps/images/gs_link_icon.png[] next t
NOTE: The image:maps/images/gs_link_icon.png[] button is only available for vector features that contain numeric properties.
The image below shows an example of data driven styling using the <<add-sample-data, Kibana sample web logs>> data set.
This image shows an example of data driven styling using the <<add-sample-data, Kibana sample web logs>> data set.
The *kibana_sample_data_logs* layer uses data driven styling for fill color and symbol size style properties.
* The `hour_of_day` property determines the fill color for each feature based on where the value fits on a linear scale.
@ -56,15 +56,13 @@ Smaller circles symbolize documents with smaller payloads, and larger circles sy
[role="screenshot"]
image::maps/images/vector_style_dynamic.png[]
[float]
[[maps-vector-style-class]]
==== Class styling
Class styling symbolizes features by class and requires multiple layers.
Use <<maps-layer-based-filtering, layer filtering>> to define the class for each layer, and <<maps-vector-style-static, static styling>> to symbolize each class.
The image below shows an example of class styling using the <<add-sample-data, Kibana sample web logs>> data set.
This image shows an example of class styling using the <<add-sample-data, Kibana sample web logs>> data set.
* The *Mac OS requests* layer applies the filter `machine.os : osx` so the layer only contains Mac OS requests.
The fill color is a static value of green.

115
docs/migration/migrate_8_0.asciidoc Normal file
View file

@ -0,0 +1,115 @@
[[breaking-changes-8.0]]
== Breaking changes in 8.0
++++
<titleabbrev>8.0</titleabbrev>
++++
This section discusses the changes that you need to be aware of when migrating
your application to Kibana 8.0.
coming[8.0.0]
See also <<release-highlights>> and <<release-notes>>.
* <<breaking_80_index_pattern_changes>>
* <<breaking_80_setting_changes>>
//NOTE: The notable-breaking-changes tagged regions are re-used in the
//Installation and Upgrade Guide
[float]
[[breaking_80_index_pattern_changes]]
=== Index pattern changes
[float]
==== Removed support for time-based internal index patterns
*Details:* Time-based interval index patterns were deprecated in 5.x. In 6.x,
you could no longer create time-based interval index patterns, but they continued
to function as expected. Support for these index patterns has been removed in 8.0.
*Impact:* You must migrate your time_based index patterns to a wildcard pattern,
for example, `logstash-*`.
[float]
[[breaking_80_setting_changes]]
=== Settings changes
// tag::notable-breaking-changes[]
[float]
==== Legacy browsers are now rejected by default
*Details:* `csp.strict` is now enabled by default, so Kibana will fail to load for older, legacy browsers that do not enforce basic Content Security Policy protections - notably Internet Explorer 11.
*Impact:* To allow Kibana to function for these legacy browsers, set `csp.strict: false`. Since this is about enforcing a security protocol, we *strongly discourage* disabling `csp.strict` unless it is critical that you support Internet Explorer 11.
[float]
==== Default logging timezone is now the system's timezone
*Details:* In prior releases the timezone used in logs defaulted to UTC. We now use the host machine's timezone by default.
*Impact:* To restore the previous behavior, in kibana.yml set `logging.timezone: UTC`.
[float]
==== Responses are never logged by default
*Details:* Previously responses would be logged if either `logging.json` was true, `logging.dest` was specified, or a `TTY` was detected.
*Impact:* To restore the previous behavior, in kibana.yml set `logging.events.response=*`.
[float]
==== `xpack.security.authProviders` is no longer valid
*Details:* The deprecated `xpack.security.authProviders` setting in the `kibana.yml` file has been removed.
*Impact:* Use `xpack.security.authc.providers` instead.
[float]
==== `xpack.security.authc.saml.realm` is now mandatory when using the SAML authentication provider
*Details:* Previously Kibana was choosing the appropriate Elasticsearch SAML realm automatically using the `Assertion Consumer Service`
URL that it derived from the actual server address. Starting in 8.0.0, the Elasticsearch SAML realm name that Kibana will use should be
specified explicitly.
*Impact:* Always define `xpack.security.authc.saml.realm` when using the SAML authentication provider.
[float]
==== `xpack.security.public` is no longer valid
*Details:* The deprecated `xpack.security.public` setting in the `kibana.yml` file has been removed.
*Impact:* Define `xpack.security.authc.saml.realm` when using the SAML authentication provider instead.
[float]
==== `/api/security/v1/saml` endpoint is no longer supported
*Details:* The deprecated `/api/security/v1/saml` endpoint is no longer supported.
*Impact:* Rely on `/api/security/saml/callback` endpoint when using SAML instead. This change should be reflected in Kibana `server.xsrf.whitelist` config as well as in Elasticsearch and Identity Provider SAML settings.
[float]
=== `optimize` directory is now in the `data` folder
*Details:* Generated bundles have moved to the configured `path.data` folder.
*Impact:* Any workflow that involved manually clearing generated bundles will have to be updated with the new path.
[float]
[[breaking_80_user_role_changes]]
=== User role changes
[float]
==== `kibana_user` role has been removed and `kibana_admin` has been added.
*Details:* The `kibana_user` role has been removed and `kibana_admin` has been added to better
reflect its intended use. This role continues to grant all access to every
{kib} feature. If you wish to restrict access to specific features, create
custom roles with {kibana-ref}/kibana-privileges.html[{kib} privileges].
*Impact:* Any users currently assigned the `kibana_user` role will need to
instead be assigned the `kibana_admin` role to maintain their current
access level.
[float]
[[breaking_80_reporting_changes]]
=== Reporting changes
[float]
==== Legacy job parameters are no longer supported
*Details:* POST URL snippets that were copied in Kibana 6.2 or earlier are no longer supported. These logs have
been deprecated with warnings that have been logged throughout 7.x. Please use Kibana UI to re-generate the
POST URL snippets if you depend on these for automated PDF reports.
// end::notable-breaking-changes[]

4
docs/settings/apm-settings.asciidoc
View file

@ -13,6 +13,10 @@ copy and paste the relevant settings below into your `kibana.yml` configuration
[[general-apm-settings-kb]]
==== General APM settings
// This content is reused in the APM app documentation.
// Any changes made in this file will be seen there as well.
// tag::general-apm-settings[]
xpack.apm.enabled:: Set to `false` to disabled the APM plugin {kib}. Defaults to
`true`.

8
docs/settings/ssl-settings.asciidoc
View file

@ -44,8 +44,8 @@ Java Cryptography Architecture documentation]. Defaults to the value of
The following settings are used to specify a private key, certificate, and the
trusted certificates that should be used when communicating over an SSL/TLS connection.
If none of the settings below are specified, the default values are used.
See {stack-ov}/security-settings.html[Default TLS/SSL settings].
If none of the settings are specified, the default values are used.
See {ref}/security-settings.html[Default TLS/SSL settings].
ifdef::server[]
A private key and certificate must be configured.
@ -54,8 +54,8 @@ ifndef::server[]
A private key and certificate are optional and would be used if the server requires client authentication for PKI
authentication.
endif::server[]
If none of the settings below are specified, the defaults values are used.
See {stack-ov}/security-settings.html[Default TLS/SSL settings].
If none of the settings bare specified, the defaults values are used.
See {ref}/security-settings.html[Default TLS/SSL settings].
[float]
===== PEM encoded files

2
docs/uptime-guide/install.asciidoc
View file

@ -20,7 +20,7 @@ then jump straight to <<install-heartbeat>>.
=== Install the stack yourself
If you'd rather install the stack yourself,
first see the https://www.elastic.co/support/matrix[Elastic Support Matrix] for information about supported operating systems and product compatibility. Then, follow the steps below.
first see the https://www.elastic.co/support/matrix[Elastic Support Matrix] for information about supported operating systems and product compatibility.
* <<install-elasticsearch>>
* <<install-kibana>>

5
docs/uptime-guide/security.asciidoc
View file

@ -1,9 +1,8 @@
[[uptime-security]]
== Elasticsearch Security
If you use Elasticsearch security, you'll need to enable certain privileges for users
that would like to access the Uptime app. Below is an example of creating
a user and support role to implement those privileges.
If you use Elasticsearch security, you'll need to enable certain privileges for users
that would like to access the Uptime app. For example, create user and support roles to implement the privileges:
[float]
=== Create a role

12
docs/user/graph/getting-started.asciidoc
View file

@ -15,7 +15,7 @@ For example, if you are indexing log data with Logstash, you could select the
`logstash-*` index pattern to visualize connections within the log entries.
. Select one or more multi-value fields that contain the terms you want to
graph.
graph.
+
The vertices in the graph are selected from these terms. If you're
visualizing connections between Apache log entries, you could select the
@ -23,12 +23,13 @@ visualizing connections between Apache log entries, you could select the
being accessed from different locations.
. Enter a search query to discover relationships between terms in the selected
fields.
fields.
+
For example, to generate a graph of the successful requests to
particular pages from different locations, you could search for the 200
response code. The weight of the connection between two vertices indicates how strongly they
are related.
are related.
+
[role="screenshot"]
image::user/graph/images/graph-url-connections.png["URL connections"]
@ -41,11 +42,11 @@ image::user/graph/images/graph-link-summary.png["Link summary"]
. Use the toolbar buttons to explore
additional connections:
+
* To display additional vertices that connect to your graph, click Expand
* To display additional vertices that connect to your graph, click Expand
image:user/graph/images/graph-expand-button.jpg[Expand Selection].
* To display additional
connections between the displayed vertices, click Link
image:user/graph/images/graph-link-button.jpg[Add links to existing terms]
image:user/graph/images/graph-link-button.jpg[Add links to existing terms]
* To explore a particular area of the
graph, select the vertices you are interested in, and click Expand or Link.
* To step back through your changes to the graph, click Undo
@ -56,7 +57,6 @@ image:user/graph/images/graph-undo-button.jpg[Undo].
[role="screenshot"]
image::user/graph/images/graph-add-query.png["Adding networks"]
NOTE: By default, when you submit a search query, Graph searches all available
fields. You can constrain your search to a particular field using the Lucene
query syntax. For example, `machine.os: osx`.

4
docs/user/monitoring/beats-details.asciidoc
View file

@ -13,8 +13,8 @@ image::user/monitoring/images/monitoring-beats.jpg["Monitoring Beats",link="imag
To view an overview of the Beats data in the cluster, click *Overview*. The
overview page has a section for activity in the last day, which is a real-time
sample of data. Below that, a summary bar and charts follow the typical paradigm
of data in the Monitoring UI, which is bound to the span of the time picker in
sample of data. The summary bar and charts follow the typical paradigm
of data in the Monitoring UI, which is bound to the span of the time filter in
the top right corner of the page. This overview page can therefore show
up-to-date or historical information.

47
docs/user/security/rbac_tutorial.asciidoc
View file

@ -10,10 +10,10 @@ Kibana spaces.
==== Scenario
Our user is a web developer working on a bank's
online mortgage service. The web developer has these
online mortgage service. The web developer has these
three requirements:
* Have access to the data for that service
* Have access to the data for that service
* Build visualizations and dashboards
* Monitor the performance of the system
@ -24,28 +24,28 @@ You'll provide the web developer with the access and privileges to get the job d
To complete this tutorial, you'll need the following:
* **Administrative privileges**: You must have a role that grants privileges to create a space, role, and user. This is any role which grants the `manage_security` cluster privilege. By default, the `superuser` role provides this access. See the {ref}/built-in-roles.html[built-in] roles.
* **A space**: In this tutorial, use `Dev Mortgage` as the space
* **Administrative privileges**: You must have a role that grants privileges to create a space, role, and user. This is any role which grants the `manage_security` cluster privilege. By default, the `superuser` role provides this access. See the {ref}/built-in-roles.html[built-in] roles.
* **A space**: In this tutorial, use `Dev Mortgage` as the space
name. See <<spaces-managing, spaces management>> for
details on creating a space.
* **Data**: You can use <<tutorial-sample-data, sample data>> or
live data. In the steps below, Filebeat and Metricbeat data are used.
* **Data**: You can use <<tutorial-sample-data, sample data>> or
live data. In the following steps, Filebeat and Metricbeat data are used.
[float]
==== Steps
With the requirements in mind, here are the steps that you will work
With the requirements in mind, here are the steps that you will work
through in this tutorial:
* Create a role named `mortgage-developer`
* Give the role permission to access the data in the relevant indices
* Give the role permission to create visualizations and dashboards
* Give the role permission to create visualizations and dashboards
* Create the web developer's user account with the proper roles
[float]
==== Create a role
Go to **Management > Roles**
Go to **Management > Roles**
for an overview of your roles. This view provides actions
for you to create, edit, and delete roles.
@ -53,21 +53,21 @@ for you to create, edit, and delete roles.
image::security/images/role-management.png["Role management"]
You can create as many roles as you like. Click *Create role* and
provide a name. Use `dev-mortgage` because this role is for a developer
You can create as many roles as you like. Click *Create role* and
provide a name. Use `dev-mortgage` because this role is for a developer
working on the bank's mortgage application.
[float]
==== Give the role permission to access the data
Access to data in indices is an index-level privilege, so in
*Index privileges*, add lines for the indices that contain the
data for this role. Two privileges are required: `read` and
`view_index_metadata`. All privileges are detailed in the
Access to data in indices is an index-level privilege, so in
*Index privileges*, add lines for the indices that contain the
data for this role. Two privileges are required: `read` and
`view_index_metadata`. All privileges are detailed in the
https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html[security privileges] documentation.
In the screenshots, Filebeat and Metricbeat data is used, but you
In the screenshots, Filebeat and Metricbeat data is used, but you
should use the index patterns for your indices.
[role="screenshot"]
@ -76,12 +76,12 @@ image::security/images/role-index-privilege.png["Index privilege"]
[float]
==== Give the role permission to create visualizations and dashboards
By default, roles do not give Kibana privileges. Click **Add space
By default, roles do not give Kibana privileges. Click **Add space
privilege** and associate this role with the `Dev Mortgage` space.
To enable users with the `dev-mortgage` role to create visualizations
and dashboards, click *All* for *Visualize* and *Dashboard*. Also
assign *All* for *Discover* because it is common for developers
To enable users with the `dev-mortgage` role to create visualizations
and dashboards, click *All* for *Visualize* and *Dashboard*. Also
assign *All* for *Discover* because it is common for developers
to create saved searches while designing visualizations.
[role="screenshot"]
@ -90,15 +90,14 @@ image::security/images/role-space-visualization.png["Associate space"]
[float]
==== Create the developer's user account with the proper roles
Go to **Management > Users** and click on **Create user** to create a
user. Give the user the `dev-mortgage` role
Go to **Management > Users** and click on **Create user** to create a
user. Give the user the `dev-mortgage` role
and the `monitoring-user` role, which is required for users of **Stack Monitoring**.
[role="screenshot"]
image::security/images/role-new-user.png["Developer user"]
Finally, have the developer log in and access the Dev Mortgage space
Finally, have the developer log in and access the Dev Mortgage space
and create a new visualization.
NOTE: If the user is assigned to only one space, they will automatically enter that space on login.

2
docs/visualize/vega.asciidoc
View file

@ -324,7 +324,7 @@ replace `"url": "data/world-110m.json"` with
`"url": "https://vega.github.io/editor/data/world-110m.json"`. Also,
regular Vega examples use `"autosize": "pad"` layout model, whereas
Kibana uses `fit`. Remove all `autosize`, `width`, and `height`
values. See link:#sizing-and-positioning[sizing and positioning] below.
values. See link:#sizing-and-positioning[sizing and positioning].
[[vega-additional-configuration-options]]
==== Additional configuration options