# Backport
This will backport the following commits from `main` to `8.8`:
- [[Security Solution] Elastic Security Assistant
(#156933)](https://github.com/elastic/kibana/pull/156933)
<!--- Backport version: 8.9.7 -->
### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)
<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"spong@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-06-02T21:19:10Z","message":"[Security
Solution] Elastic Security Assistant (#156933)\n\n## [Security Solution]
Elastic Security Assistant\r\n\r\nThe _Elastic Security Assistant_ has
entered the chat, integrating generative AI and large language models
(LLMs) into the workflows of Elastic Security users.\r\n\r\nBring your
alerts, events, rules, and data quality checks into the
conversation.\r\n\r\n<31d65c78-5692-4817-b726-820c5df0801c>\r\n\r\nThis
PR merges a feature branch developed by @spong and @andrew-goldstein ,
seeded by @jamesspi 's prototype of the assistant. Connectivity to LLMs
is provided the [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) , developed
by @stephmilovic . This PR includes:\r\n\r\n- A new reusable Kibana
package containing the assistant:
`x-pack/packages/kbn-elastic-assistant`\r\n - See the `How to embed the
Assistant in other parts of Kibana` for details\r\n- Assistant
integration into Elastic Security Solution workflows (e.g. alerts,
cases, Timeline, rules, data quality)\r\n\r\n### An assistant trained on
the Elastic stack and Elastic Security\r\n\r\nThe [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) connects the
assistant to OpenAI and Azure OpenAI models trained with knowledge of
the Elastic stack and the Elastic Security solution, including:\r\n\r\n-
The Elastic open [Detection
Rules](https://github.com/elastic/detection-rules)\r\n- The [Elastic
Common Schema
(ECS)](https://www.elastic.co/guide/en/ecs/current/index.html)\r\n-
Elastic query languages, including
[KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html),
[EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html),
and the [Elastic Query
DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html)\r\n-
[Elasticsearch API
documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/rest-apis.html)\r\n\r\nThis
training enables the assistant to offer fully interactive chat
experiences that include:\r\n\r\n- alert summarization\r\n- interactive
query generation\r\n- workflow suggestions\r\n- generating ingestion
configurations that conform to the Elastic Common Schema\r\n- your
imagination\r\n\r\nusing context from Elastic Security.\r\n\r\n### Take
action from your conversations\r\n\r\nThe Actions (from assistant
response):\r\n\r\n- Send KQL to Timeline\r\n- Send EQL to Timeline\r\n-
Send Elasticsearch DSL to Timeline\r\n- Send Note to timeline\r\n-
Create new case\r\n- Add to existing case\r\n- Copy to
clipboard\r\n\r\n### Components architecture diagram\r\n\r\n\r\n\r\n###
How to embed the Assistant in other parts of Kibana\r\n\r\nFollow the
general instructions in `x-pack/packages/kbn-elastic-assistant/index.ts`
to integrate the assistant into a Kibana app.\r\n\r\n#### Step 1 - Wrap
your Kibana app in the `AssistantProvider` component\r\n\r\n```ts\r\n//
Step 1: Wrap your Kibana app in the `AssistantProvider` component. This
typically\r\n// happens in the root of your app. Optionally provide a
custom title for the assistant:\r\n\r\n/** provides context (from the
app) to the assistant, and injects Kibana services, like `http`
*/\r\nexport { AssistantProvider } from
'./impl/assistant_context';\r\n```\r\n\r\n#### Step 2: Add the
`AssistantOverlay` component to your app\r\n\r\n```ts\r\n// Step 2: Add
the `AssistantOverlay` component to your app. This component displays
the assistant\r\n// overlay in a modal, bound to a shortcut
key:\r\n\r\n/** modal overlay for Elastic Assistant conversations
*/\r\nexport { AssistantOverlay } from
'./impl/assistant/assistant_overlay';\r\n\r\n// In addition to the
`AssistantOverlay`, or as an alternative, you may use the `Assistant`
component\r\n// to display the assistant without the modal
overlay:\r\n\r\n/** this component renders the Assistant without the
modal overlay to, for example, render it in a Timeline tab */\r\nexport
{ Assistant } from './impl/assistant';\r\n```\r\n\r\n#### Step 3:
Wherever you want to bring context into the assistant, use the any
combination of the following\r\n\r\n```ts\r\n// Step 3: Wherever you
want to bring context into the assistant, use the any combination of the
following\r\n// components and hooks:\r\n// - `NewChat` component\r\n//
- `NewChatById` component\r\n// - `useAssistantOverlay`
hook\r\n\r\n/**\r\n * `NewChat` displays a _New chat_ icon button,
providing all the context\r\n * necessary to start a new chat. You may
optionally style the button icon,\r\n * or override the default _New
chat_ text with custom content, like `🪄✨`\r\n *\r\n * USE THIS WHEN: All
the data necessary to start a new chat is available\r\n * in the same
part of the React tree as the _New chat_ button.\r\n */\r\nexport {
NewChat } from './impl/new_chat';\r\n\r\n/**\r\n * `NewChatByID`
displays a _New chat_ icon button by providing only the
`promptContextId`\r\n * of a context that was (already) registered by
the `useAssistantOverlay` hook. You may\r\n * optionally style the
button icon, or override the default _New chat_ text with custom\r\n *
content, like {'🪄✨'}\r\n *\r\n * USE THIS WHEN: all the data necessary
to start a new chat is NOT available\r\n * in the same part of the React
tree as the _New chat_ button. When paired\r\n * with the
`useAssistantOverlay` hook, this option enables context to be be\r\n *
registered where the data is available, and then the _New chat_ button
can be displayed\r\n * in another part of the tree.\r\n */\r\nexport {
NewChatById } from './impl/new_chat_by_id';\r\n\r\n/**\r\n *
`useAssistantOverlay` is a hook that registers context with the
assistant overlay, and\r\n * returns an optional `showAssistantOverlay`
function to display the assistant overlay.\r\n * As an alterative to
using the `showAssistantOverlay` returned from this hook, you may\r\n *
use the `NewChatById` component and pass it the `promptContextId`
returned by this hook.\r\n *\r\n * USE THIS WHEN: You want to register
context in one part of the tree, and then show\r\n * a _New chat_ button
in another part of the tree without passing around the data, or when\r\n
* you want to build a custom `New chat` button with features not not
provided by the\r\n * `NewChat` component.\r\n */\r\nexport {
useAssistantOverlay } from
'./impl/assistant/use_assistant_overlay';\r\n```\r\n\r\nCo-authored-by:
Garrett Spong <garrett.spong@elastic.co>\r\nCo-authored-by: Andrew Macri
<andrew.macri@elastic.co>","sha":"4e38817a4ddfea8aff336c22788bc3a30ece5908","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:
SecuritySolution","release_note:feature","ci:no-auto-commit","v8.9.0","v8.8.1"],"number":156933,"url":"https://github.com/elastic/kibana/pull/156933","mergeCommit":{"message":"[Security
Solution] Elastic Security Assistant (#156933)\n\n## [Security Solution]
Elastic Security Assistant\r\n\r\nThe _Elastic Security Assistant_ has
entered the chat, integrating generative AI and large language models
(LLMs) into the workflows of Elastic Security users.\r\n\r\nBring your
alerts, events, rules, and data quality checks into the
conversation.\r\n\r\n<31d65c78-5692-4817-b726-820c5df0801c>\r\n\r\nThis
PR merges a feature branch developed by @spong and @andrew-goldstein ,
seeded by @jamesspi 's prototype of the assistant. Connectivity to LLMs
is provided the [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) , developed
by @stephmilovic . This PR includes:\r\n\r\n- A new reusable Kibana
package containing the assistant:
`x-pack/packages/kbn-elastic-assistant`\r\n - See the `How to embed the
Assistant in other parts of Kibana` for details\r\n- Assistant
integration into Elastic Security Solution workflows (e.g. alerts,
cases, Timeline, rules, data quality)\r\n\r\n### An assistant trained on
the Elastic stack and Elastic Security\r\n\r\nThe [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) connects the
assistant to OpenAI and Azure OpenAI models trained with knowledge of
the Elastic stack and the Elastic Security solution, including:\r\n\r\n-
The Elastic open [Detection
Rules](https://github.com/elastic/detection-rules)\r\n- The [Elastic
Common Schema
(ECS)](https://www.elastic.co/guide/en/ecs/current/index.html)\r\n-
Elastic query languages, including
[KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html),
[EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html),
and the [Elastic Query
DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html)\r\n-
[Elasticsearch API
documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/rest-apis.html)\r\n\r\nThis
training enables the assistant to offer fully interactive chat
experiences that include:\r\n\r\n- alert summarization\r\n- interactive
query generation\r\n- workflow suggestions\r\n- generating ingestion
configurations that conform to the Elastic Common Schema\r\n- your
imagination\r\n\r\nusing context from Elastic Security.\r\n\r\n### Take
action from your conversations\r\n\r\nThe Actions (from assistant
response):\r\n\r\n- Send KQL to Timeline\r\n- Send EQL to Timeline\r\n-
Send Elasticsearch DSL to Timeline\r\n- Send Note to timeline\r\n-
Create new case\r\n- Add to existing case\r\n- Copy to
clipboard\r\n\r\n### Components architecture diagram\r\n\r\n\r\n\r\n###
How to embed the Assistant in other parts of Kibana\r\n\r\nFollow the
general instructions in `x-pack/packages/kbn-elastic-assistant/index.ts`
to integrate the assistant into a Kibana app.\r\n\r\n#### Step 1 - Wrap
your Kibana app in the `AssistantProvider` component\r\n\r\n```ts\r\n//
Step 1: Wrap your Kibana app in the `AssistantProvider` component. This
typically\r\n// happens in the root of your app. Optionally provide a
custom title for the assistant:\r\n\r\n/** provides context (from the
app) to the assistant, and injects Kibana services, like `http`
*/\r\nexport { AssistantProvider } from
'./impl/assistant_context';\r\n```\r\n\r\n#### Step 2: Add the
`AssistantOverlay` component to your app\r\n\r\n```ts\r\n// Step 2: Add
the `AssistantOverlay` component to your app. This component displays
the assistant\r\n// overlay in a modal, bound to a shortcut
key:\r\n\r\n/** modal overlay for Elastic Assistant conversations
*/\r\nexport { AssistantOverlay } from
'./impl/assistant/assistant_overlay';\r\n\r\n// In addition to the
`AssistantOverlay`, or as an alternative, you may use the `Assistant`
component\r\n// to display the assistant without the modal
overlay:\r\n\r\n/** this component renders the Assistant without the
modal overlay to, for example, render it in a Timeline tab */\r\nexport
{ Assistant } from './impl/assistant';\r\n```\r\n\r\n#### Step 3:
Wherever you want to bring context into the assistant, use the any
combination of the following\r\n\r\n```ts\r\n// Step 3: Wherever you
want to bring context into the assistant, use the any combination of the
following\r\n// components and hooks:\r\n// - `NewChat` component\r\n//
- `NewChatById` component\r\n// - `useAssistantOverlay`
hook\r\n\r\n/**\r\n * `NewChat` displays a _New chat_ icon button,
providing all the context\r\n * necessary to start a new chat. You may
optionally style the button icon,\r\n * or override the default _New
chat_ text with custom content, like `🪄✨`\r\n *\r\n * USE THIS WHEN: All
the data necessary to start a new chat is available\r\n * in the same
part of the React tree as the _New chat_ button.\r\n */\r\nexport {
NewChat } from './impl/new_chat';\r\n\r\n/**\r\n * `NewChatByID`
displays a _New chat_ icon button by providing only the
`promptContextId`\r\n * of a context that was (already) registered by
the `useAssistantOverlay` hook. You may\r\n * optionally style the
button icon, or override the default _New chat_ text with custom\r\n *
content, like {'🪄✨'}\r\n *\r\n * USE THIS WHEN: all the data necessary
to start a new chat is NOT available\r\n * in the same part of the React
tree as the _New chat_ button. When paired\r\n * with the
`useAssistantOverlay` hook, this option enables context to be be\r\n *
registered where the data is available, and then the _New chat_ button
can be displayed\r\n * in another part of the tree.\r\n */\r\nexport {
NewChatById } from './impl/new_chat_by_id';\r\n\r\n/**\r\n *
`useAssistantOverlay` is a hook that registers context with the
assistant overlay, and\r\n * returns an optional `showAssistantOverlay`
function to display the assistant overlay.\r\n * As an alterative to
using the `showAssistantOverlay` returned from this hook, you may\r\n *
use the `NewChatById` component and pass it the `promptContextId`
returned by this hook.\r\n *\r\n * USE THIS WHEN: You want to register
context in one part of the tree, and then show\r\n * a _New chat_ button
in another part of the tree without passing around the data, or when\r\n
* you want to build a custom `New chat` button with features not not
provided by the\r\n * `NewChat` component.\r\n */\r\nexport {
useAssistantOverlay } from
'./impl/assistant/use_assistant_overlay';\r\n```\r\n\r\nCo-authored-by:
Garrett Spong <garrett.spong@elastic.co>\r\nCo-authored-by: Andrew Macri
<andrew.macri@elastic.co>","sha":"4e38817a4ddfea8aff336c22788bc3a30ece5908"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/156933","number":156933,"mergeCommit":{"message":"[Security
Solution] Elastic Security Assistant (#156933)\n\n## [Security Solution]
Elastic Security Assistant\r\n\r\nThe _Elastic Security Assistant_ has
entered the chat, integrating generative AI and large language models
(LLMs) into the workflows of Elastic Security users.\r\n\r\nBring your
alerts, events, rules, and data quality checks into the
conversation.\r\n\r\n<31d65c78-5692-4817-b726-820c5df0801c>\r\n\r\nThis
PR merges a feature branch developed by @spong and @andrew-goldstein ,
seeded by @jamesspi 's prototype of the assistant. Connectivity to LLMs
is provided the [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) , developed
by @stephmilovic . This PR includes:\r\n\r\n- A new reusable Kibana
package containing the assistant:
`x-pack/packages/kbn-elastic-assistant`\r\n - See the `How to embed the
Assistant in other parts of Kibana` for details\r\n- Assistant
integration into Elastic Security Solution workflows (e.g. alerts,
cases, Timeline, rules, data quality)\r\n\r\n### An assistant trained on
the Elastic stack and Elastic Security\r\n\r\nThe [Generative AI
Connector](<https://github.com/elastic/kibana/pull/157228>) connects the
assistant to OpenAI and Azure OpenAI models trained with knowledge of
the Elastic stack and the Elastic Security solution, including:\r\n\r\n-
The Elastic open [Detection
Rules](https://github.com/elastic/detection-rules)\r\n- The [Elastic
Common Schema
(ECS)](https://www.elastic.co/guide/en/ecs/current/index.html)\r\n-
Elastic query languages, including
[KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html),
[EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html),
and the [Elastic Query
DSL](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html)\r\n-
[Elasticsearch API
documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/rest-apis.html)\r\n\r\nThis
training enables the assistant to offer fully interactive chat
experiences that include:\r\n\r\n- alert summarization\r\n- interactive
query generation\r\n- workflow suggestions\r\n- generating ingestion
configurations that conform to the Elastic Common Schema\r\n- your
imagination\r\n\r\nusing context from Elastic Security.\r\n\r\n### Take
action from your conversations\r\n\r\nThe Actions (from assistant
response):\r\n\r\n- Send KQL to Timeline\r\n- Send EQL to Timeline\r\n-
Send Elasticsearch DSL to Timeline\r\n- Send Note to timeline\r\n-
Create new case\r\n- Add to existing case\r\n- Copy to
clipboard\r\n\r\n### Components architecture diagram\r\n\r\n\r\n\r\n###
How to embed the Assistant in other parts of Kibana\r\n\r\nFollow the
general instructions in `x-pack/packages/kbn-elastic-assistant/index.ts`
to integrate the assistant into a Kibana app.\r\n\r\n#### Step 1 - Wrap
your Kibana app in the `AssistantProvider` component\r\n\r\n```ts\r\n//
Step 1: Wrap your Kibana app in the `AssistantProvider` component. This
typically\r\n// happens in the root of your app. Optionally provide a
custom title for the assistant:\r\n\r\n/** provides context (from the
app) to the assistant, and injects Kibana services, like `http`
*/\r\nexport { AssistantProvider } from
'./impl/assistant_context';\r\n```\r\n\r\n#### Step 2: Add the
`AssistantOverlay` component to your app\r\n\r\n```ts\r\n// Step 2: Add
the `AssistantOverlay` component to your app. This component displays
the assistant\r\n// overlay in a modal, bound to a shortcut
key:\r\n\r\n/** modal overlay for Elastic Assistant conversations
*/\r\nexport { AssistantOverlay } from
'./impl/assistant/assistant_overlay';\r\n\r\n// In addition to the
`AssistantOverlay`, or as an alternative, you may use the `Assistant`
component\r\n// to display the assistant without the modal
overlay:\r\n\r\n/** this component renders the Assistant without the
modal overlay to, for example, render it in a Timeline tab */\r\nexport
{ Assistant } from './impl/assistant';\r\n```\r\n\r\n#### Step 3:
Wherever you want to bring context into the assistant, use the any
combination of the following\r\n\r\n```ts\r\n// Step 3: Wherever you
want to bring context into the assistant, use the any combination of the
following\r\n// components and hooks:\r\n// - `NewChat` component\r\n//
- `NewChatById` component\r\n// - `useAssistantOverlay`
hook\r\n\r\n/**\r\n * `NewChat` displays a _New chat_ icon button,
providing all the context\r\n * necessary to start a new chat. You may
optionally style the button icon,\r\n * or override the default _New
chat_ text with custom content, like `🪄✨`\r\n *\r\n * USE THIS WHEN: All
the data necessary to start a new chat is available\r\n * in the same
part of the React tree as the _New chat_ button.\r\n */\r\nexport {
NewChat } from './impl/new_chat';\r\n\r\n/**\r\n * `NewChatByID`
displays a _New chat_ icon button by providing only the
`promptContextId`\r\n * of a context that was (already) registered by
the `useAssistantOverlay` hook. You may\r\n * optionally style the
button icon, or override the default _New chat_ text with custom\r\n *
content, like {'🪄✨'}\r\n *\r\n * USE THIS WHEN: all the data necessary
to start a new chat is NOT available\r\n * in the same part of the React
tree as the _New chat_ button. When paired\r\n * with the
`useAssistantOverlay` hook, this option enables context to be be\r\n *
registered where the data is available, and then the _New chat_ button
can be displayed\r\n * in another part of the tree.\r\n */\r\nexport {
NewChatById } from './impl/new_chat_by_id';\r\n\r\n/**\r\n *
`useAssistantOverlay` is a hook that registers context with the
assistant overlay, and\r\n * returns an optional `showAssistantOverlay`
function to display the assistant overlay.\r\n * As an alterative to
using the `showAssistantOverlay` returned from this hook, you may\r\n *
use the `NewChatById` component and pass it the `promptContextId`
returned by this hook.\r\n *\r\n * USE THIS WHEN: You want to register
context in one part of the tree, and then show\r\n * a _New chat_ button
in another part of the tree without passing around the data, or when\r\n
* you want to build a custom `New chat` button with features not not
provided by the\r\n * `NewChat` component.\r\n */\r\nexport {
useAssistantOverlay } from
'./impl/assistant/use_assistant_overlay';\r\n```\r\n\r\nCo-authored-by:
Garrett Spong <garrett.spong@elastic.co>\r\nCo-authored-by: Andrew Macri
<andrew.macri@elastic.co>","sha":"4e38817a4ddfea8aff336c22788bc3a30ece5908"}},{"branch":"8.8","label":"v8.8.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
# Backport
This will backport the following commits from `main` to `8.8`:
- [[ML] Apply theme based on the User Profile settings
(#158258)](https://github.com/elastic/kibana/pull/158258)
<!--- Backport version: 8.9.7 -->
### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)
<!--BACKPORT [{"author":{"name":"Dima
Arnautov","email":"dmitrii.arnautov@elastic.co"},"sourceCommit":{"committedDate":"2023-05-25T09:57:48Z","message":"[ML]
Apply theme based on the User Profile settings (#158258)\n\n##
Summary\r\n\r\nWith the release of Per User Dark Mode, code should no
longer rely on\r\ncalling `uiSettings` to determine which theme Kibana
is displayed with.\r\n\r\nWith theme settings now configurable from User
Profiles and Adv.\r\nSettings, the code that was calling uiSettings to
determine the Kibana\r\ntheme will not take into account which theme is
currently being\r\ndisplayed.\r\n\r\n\r\nApplies an appropriate EUI
theme based on the profile settings. In\r\nparticular for the following
components:\r\n- Anomaly swim lane (Fixes#158155 )\r\n- Job tree map
view (Fixes\r\nhttps://github.com/elastic/kibana/issues/158304)\r\n-
Charts-related theme settings, e.g. the Single Metric
Viewer","sha":"c5eee26671ea5e215e5182b29562f6ffe5476965","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix",":ml","Team:ML","v8.9.0","v8.8.1"],"number":158258,"url":"https://github.com/elastic/kibana/pull/158258","mergeCommit":{"message":"[ML]
Apply theme based on the User Profile settings (#158258)\n\n##
Summary\r\n\r\nWith the release of Per User Dark Mode, code should no
longer rely on\r\ncalling `uiSettings` to determine which theme Kibana
is displayed with.\r\n\r\nWith theme settings now configurable from User
Profiles and Adv.\r\nSettings, the code that was calling uiSettings to
determine the Kibana\r\ntheme will not take into account which theme is
currently being\r\ndisplayed.\r\n\r\n\r\nApplies an appropriate EUI
theme based on the profile settings. In\r\nparticular for the following
components:\r\n- Anomaly swim lane (Fixes#158155 )\r\n- Job tree map
view (Fixes\r\nhttps://github.com/elastic/kibana/issues/158304)\r\n-
Charts-related theme settings, e.g. the Single Metric
Viewer","sha":"c5eee26671ea5e215e5182b29562f6ffe5476965"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/158258","number":158258,"mergeCommit":{"message":"[ML]
Apply theme based on the User Profile settings (#158258)\n\n##
Summary\r\n\r\nWith the release of Per User Dark Mode, code should no
longer rely on\r\ncalling `uiSettings` to determine which theme Kibana
is displayed with.\r\n\r\nWith theme settings now configurable from User
Profiles and Adv.\r\nSettings, the code that was calling uiSettings to
determine the Kibana\r\ntheme will not take into account which theme is
currently being\r\ndisplayed.\r\n\r\n\r\nApplies an appropriate EUI
theme based on the profile settings. In\r\nparticular for the following
components:\r\n- Anomaly swim lane (Fixes#158155 )\r\n- Job tree map
view (Fixes\r\nhttps://github.com/elastic/kibana/issues/158304)\r\n-
Charts-related theme settings, e.g. the Single Metric
Viewer","sha":"c5eee26671ea5e215e5182b29562f6ffe5476965"}},{"branch":"8.8","label":"v8.8.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
closes: https://github.com/elastic/kibana/issues/155301
Moves _packages/security-solution/_ to
_x-pack/packages/security-solution/_
Moves _x-pack/packages/kbn-securitysolution-*_ into the new
_x-pack/packages/security-solution/_
It contains 3 packages now:
- data_view/
- ecs_data_quality_dashboard/
- side_nav/
Package names and ids have not changed.
## Other
- eslint configured for all the packages in the directory
- i18n prefix `securitySolutionPackages` configured for all packages in
the directory
- generic storybook configuration, run with: `yarn storybook
security_solution_packages`
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Allow user's to set their desired theme on their User Profile
## How to test
Login as a non-cloud user, navigate to User Profile:
<img width="1051" alt="Screenshot 2023-02-28 at 1 40 34 PM"
src="https://user-images.githubusercontent.com/21210601/221948512-a3e9b485-d3fa-4646-ae7d-63a68777cf19.png">
## Release Note
Users can now select their theme preference for Kibana in their User
Profile
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Michael Marcialis <michael.l.marcialis@gmail.com>
Closes#154733
Creates a new plugin for logs onboarding with wizard to organize steps
into discrete views.
#### TODO:
- [x] rename plugin to observability_onboarding
- [x] configure: UI and server plugin
- [x] enable/disable new plugin
- [x] remove the link to it from Observability nav
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Yngrid Coello <yngrid.coello@elastic.co>
Co-authored-by: Yngrid Coello <yngrdyn@gmail.com>
## Summary
Abstract types for using Saved Objects with the content management api.
This should significantly reduce the amount of code to use additional
saved object types.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
- Moves code from `x-pack/plugins/ml/common/util/errors` that was shared
via `x-pack/plugins/ml/public/shared.ts` to `@kbn/ml-error-utils`.
- `data_visualizer` and `aiops` plugins now use that package instead of
code duplication.
- Refactors individual helpers to manage the `random_sampler`
aggregation into a single reusable wrapper. The helper's factory can be
supplied with either a sample probability right away or a document count
to generate a dynamic sample probability based on it.
- Applies random sampling to the main date histogram chart.
Closes#153202, closes#153850
## Summary
This PR adds alert start annotation and also uses a custom time range
for the alert details' charts depending on the alert duration. The logic
to calculate the time range was added in a separate package to be used
in other use cases as well.
## 🧪 How to test
Create a metric threshold alert and go to the related alert details
page, verify:
- Alert start annotation
- The time range of the charts should be before the alert was started
(1/8 of the duration was added to each side)
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Now that we merged https://github.com/elastic/kibana/pull/153543, this
PR exposes the versioned router for teams to start using. The versioned
router will be available on `IRouter` under a new `versioned` property.
Primary benefit of this approach is that plugin developers will not need
to do anything other than "get" the `versioned` property to get a
versioned router.
Drawback is that this precludes us from passing in additional
configuration, like a version, to scope the versioned router instance.
For that we would need some kind of `createVersionedRouter({ version:
... })`. At this point it is not clear this is necessary, we could
revisit this decision based on actual usage. Plugin developers could
also do something like:
```ts
// common const
const MY_API_VERSION: ApiVersion = '1';
// in routes
import {MY_API_VERSION} from '../from/common';
router.versioned.get({ path: ... })
.addVersion({ version: MY_API_VERSION });
```
In this way they could get many of the same benefits of a version-scoped
version router, with the drawback that they need to pass this in for
every route.
### TODO
- [x] Add an integration test for the versioned router
### Future work
* We still need to consider revisiting some of the router design to
better support internal cases like adding support for registering a
handler for a version range and adding a default version to continue
supporting on-prem where introducing versions will be a breaking change
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Creates a package for sharing general trained model util code.
Initially only contains the constants which had been copied in the
enterprise search plugin.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
resolves https://github.com/elastic/kibana/issues/142874
The alerting framework now generates an alert UUID for every alert it
creates. The UUID will be reused for alerts which continue to be active
on subsequent runs, until the alert recovers. When the same alert (alert
instance id) becomes active again, a new UUID will be generated. These
UUIDs then identify a "span" of events for a single alert.
The rule registry plugin was already adding these UUIDs to it's own
alerts-as-data indices, and that code has now been changed to make use
of the new UUID the alerting framework generates.
- adds property in the rule task state
`alertInstances[alertInstanceId].meta.uuid`; this is where the alert
UUID is persisted across runs
- adds a new `Alert` method getUuid(): string` that can be used by rule
executors to obtain the UUID of the alert they just retrieved from the
factory; the rule registry uses this to get the UUID generated by the
alerting framework
- for the event log, adds the property `kibana.alert.uuid` to
`*-instance` event log events; this is the same field the rule registry
writes into the alerts-as-data indices
- various changes to tests to accommodate new UUID data / methods
- migrates the UUID previous stored with lifecycle alerts in the alert
state, via the rule registry *INTO* the new `meta.uuid` field in the
existing alert state.
## Summary
Implements the designs from
https://github.com/elastic/kibana/pull/151596
* Move `packages/versioning/*` into `packages/core/http` to follow
existing structure more closely
* Implements the first iteration of the versioned router as a
wrapper/layer around the existing router
* Adds some integration tests
* Future work needed! Once we have a the versioned spec we should
implement it in this wrapper layer
* Validation is a little bit tricky because of when the
`CoreKibanaResponse` object is instantiated, the approach taken here is
to replace body, params, query on the route-level's request object
Closes https://github.com/elastic/kibana/issues/149286
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Closes https://github.com/elastic/kibana/issues/151702
## Summary
This PR migrates drag and drop logic from Lens plugin to a new package
so we can reuse it on Discover page later. At this point there should be
no visual changes. If you notice something, please comment on the PR.
- [x] Migrate drag&drop code to its own package `@kbn/dom-drag-drop`
- [x] Clean up i18n strings
- [x] Clean up styles
- [x] Adjust tests
- [x] Make telemetry optional
- [x] Configurable `data-test-subj`
Please test by using your mouse and also by using keyword shortcuts.
# Next steps
- Redesign for field list item (smaller button, a separate handle icon,
pill styles)
- Redesign for draggable buttons in the Lens layer panels (smaller
buttons)
-
[Figma](https://www.figma.com/file/SvpfCqaZPb2iAYnPtd0Gnr/KUI-Library?node-id=674%3A198901&t=OnQH2EQ4fdBjsRLp-0)
- https://github.com/elastic/kibana/issues/151703
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
## Summary
This plugin will contain the asset inventory and topology API in Kibana,
giving Kibana projects access to inventory and topology data via an HTTP
and/or JS API on the server and client.
[Currently proposed API
docs](https://github.com/elastic/o11y-topology-playground/tree/main/docs/api)
will be moved to this repo as well, contained inside this plugin folder,
as a part of this PR.
## Enabling the plugin
This plugin is entirely in "technical preview" and because of this, must
be specifically enabled via config for it to do anything besides being
run by the core plugin framework. To enable the server API layer, as
well as the index template management, put the following line in your
kibana.yml file:
```yml
xpack.assetManager.alphaEnabled: true
```
## Running the API integration tests
Run the functional test server with the asset manager config in place:
```shell
$ node scripts/functional_tests_server --config x-pack/test/api_integration/apis/asset_manager/config.ts
```
Then run the functional test runner with the same config, to target just
these tests:
```shell
$ node scripts/functional_test_runner --config=x-pack/test/api_integration/apis/asset_manager/config.
ts
```
_Note:_ The config file added in this folder enables the tech preview
plugin ([see file
here](https://github.com/elastic/kibana/pull/152456/files#diff-bc00de6c34c9bc131cfbdf3570c487fe9ee947e9a88a84c59d6b139b79d7708eR20)).
### Running the integration tests for verifying that the plugin is
"disabled" by default
There is a small set of tests that confirm that the endpoints return 404
and there is no index template installed if the config value is not set
in the kibana.yml file. To run this suite, use the following config:
```shell
$ node scripts/functional_tests_server --config x-pack/test/api_integration/apis/asset_manager/config_when_disabled.ts
$ node scripts/functional_test_runner --config=x-pack/test/api_integration/apis/asset_manager/config_when_disabled.
ts
```
## Testing this PR with sample data
There are some sample data mechanisms in place inside this PR to allow
us to build out the endpoints.
### View sample docs
```http
GET /api/asset-manager/assets/sample
```
This will return a list of the assets that are included if you elect to
write assets. This is a good endpoint to use to find EAN (Elastic Asset
Name) values that you may want to exclude from writing for a given time
period, to simulate assets appearing/disappearing over time.
### Write sample docs
```http
POST /api/asset-manager/assets/sample
{
"baseDateTime": "2023-02-28T12:00:00.000Z",
"excludeEans": ["k8s.cluster:cluster-002"]
}
```
This posts all of the sample asset documents to Elasticsearch using the
`baseDateTime` value as the timestamp. Any valid string or number that
is accepted by `new Date()` should work for `baseDateTime`.
The `excludeEans` value is an array of EAN ("Elastic Asset Name") values
that you don't want to write on this particular run. This way you can
have assets appear (exclude them in the past, don't exclude them during
a later run) or disappear (vice versa) and see how that shows up in
other endpoints.
**Note:** *Remember that when you curl a Kibana server API with a POST
request, you must include a `kbn-xsrf` header with any string value you
want.*
### Get asset docs from ES
```http
GET /api/asset-manager/assets?type=k8s.cluster&from=now-10m
```
This is the primary "real" endpoint available right now. It should
retrieve a list of assets based on the type/from/to/ean filter values
you specify. Once you load the sample data, this endpoint should return
results.
## Debug logging
There are some extra debug logs for ES queries that are running in the
code in this PR. To print those logs to the Kibana server console, run
Kibana using `DEBUG_LOGGER=true`
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Resolves https://github.com/elastic/kibana/issues/144887
## Summary
This PR adds an ESLint Plugin which checks specific `Eui` elements for
the existence of a `data-test-subj` prop. This rule will make having one
for these elements required.
This rule is currently only enabled for Observability apps (APM, Infra,
Observability, Synthetics, Uptime).
The plugin is also able to generate a suggestion based on the context in
which the element is used. In the IDE this suggestion can be applied by
using the autofix capability (see video below).
When opening a PR, the CI will automatically apply the suggestion to
qualifying Eui elements in the branch.
https://user-images.githubusercontent.com/535564/225449622-bbfccb40-fdd2-4f69-9d5a-7d5a97bf62e6.mov
## Why do this?
There is an increased push to move towards data driven feature
development. In order to facilitate this, we need to have an increased
focus on instrumenting user event generating elements in the Kibana
codebase. This linting rule is an attempt to nudge Kibana engineers to
not forget to add this property when writing frontend code. It also
saves a bit of work for engineers by suggesting a value for the
`data-test-subj` based on the location of the file in the codebase and
any potential default values that might be present in the JSX node tree.
Finally, because the suggestion is always of the same form, it can
increase the consistency in the values given to these elements.
## Shape of the suggestion
The suggestion for the value of data-test-subj is of the form:
`[app][componentName][intent][euiElementName]`.
For example, when working in a component in the location:
`x-pack/plugins/observability/public/pages/overview/containers/overview_page/header_actions.tsx`,
and having the code:
```
function HeaderActions() {
return (
<EuiButton>{i18n.translate('id', { defaultMessage: 'Submit Form' })}</EuiButton>
)
}
```
the suggestion becomes:
`data-test-subj=o11yHeaderActionsSubmitFormButton`.
For elements that don't take a `defaultMessage` prop / translation, the
suggestion takes the form: `[app][componentName][euiElementName]`
## Which elements are checked by the ESLint rule?
In its current iteration the rule checks these Eui elements:
* `EuiButton`
* `EuiButtonEmpty`
* `EuiLink`
* `EuiFieldText`
* `EuiFieldSearch`
* `EuiFieldNumber`
* `EuiSelect`
* `EuiRadioGroup`
* 'EuiTextArea`
## What types of prop setting does this rule support?
* `<EuiButton data-test-subj="foo">` (direct prop)
* `<EuiButton {...foo}>` (via spreaded object; rule checks for
`data-test-subj` key in object)
## What types of function declarations does this rule support?
* `function Foo(){}` (Named function)
* `const Foo = () => {}` (Arrow function assigned to variable)
* `const Foo = memo(() => {})` (Arrow function assigned to variable
wrapped in function)
* `const Foo = hoc(uponHoc(uponHoc(() => {})))` (Arrow function assigned
to variable wrapped in infinite levels of functions)
## Things to note
* If an element already has a value for `data-test-subj` the rule will
not kick in as any existing instrumentation might depend on the value.
* the auto suggestion is just a suggestion: the engineer can always
adjust the value for a `data-test-subj` before or after committing. Once
a value is present (autofixed or manually set) the rule will not kick
in.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Dario Gieselaar <d.gieselaar@gmail.com>
Co-authored-by: Katerina Patticha <kate@kpatticha.com>
Co-authored-by: Tiago Costa <tiago.costa@elastic.co>
## Summary
Close https://github.com/elastic/kibana/issues/152002
In https://github.com/elastic/kibana/pull/151163 we introduced a simple
demo todo app run in a storybook with a custom client-side content
management client (no server-side cm registry usage).
This is a follow-up PR that re-uses the same demo todo app, but also
runs it in an example plugin with proper server-side content management
registry usage, so now we have a basic end-to-end demonstration of
content management capabilities. The demo app is covered by functional
tests, so now we also have basic end-to-end test coverage.
As this is the first kind of real-world end-to-end usage of the CM APIs,
I'd like to use this and
[previous](https://github.com/elastic/kibana/pull/151163) prs as a base
for the discussion and polishing current APIs. I'll leave a review with
comments where I think some API polishing is needed.
**Notable changes apart from the example plugin itself:**
1. Move `demo/` todo app and its stories introduced in
https://github.com/elastic/kibana/pull/151163 from
`src/plugins/content_management` to
`examples/content_management_examples`. This was mostly needed to not
export `demo/` code on the public plugin export to avoid increasing
bundle size.
2. Add needed exports to the plugin contract
3. Reshuffle `common/` to not import `@kbn/schema` client side
48aa41403b
4. Fix client-side RPC client to work with the latest server-side
changes (shouldn't break from now on because of the end-to-end test
coverage)
Resolves https://github.com/elastic/kibana/issues/150358
## Summary
In a previous [PR](https://github.com/elastic/kibana/pull/145581) we
started installing a common component template for framework alerts as
data when the `xpack.alerting.enableFrameworkAlerts` config flag is set
to true. In that PR we used a different naming pattern than what is used
by the rule registry for its component templates.
In this PR we are doing the following:
* Renaming the installed `alerts-common-component-template` to
`.alerts-framework-mappings`.
* Creating and installing `.alerts-legacy-alert-mappings` component
template when `enableFrameworkAlerts: true` on alerting plugin setup
* The combination of the two component templates creates the same set of
mappings as the rule registry technical component template
* Creating and installing `.alerts-ecs-mappings` component template when
`enableFrameworkAlerts: true` on alerting plugin setup (when
`enableFrameworkAlerts: false`, the rule registry continues to install
this component template
* Using the `@kbn/ecs` package provided by core to generate the ECS
field map. The rule registry will continue to install the existing ECS
field map which is actually a subset of ECS fields
* Adding `useLegacy` and `useEcs` flags that allow rule types to specify
whether to include the legacy alerts component template and the ECS
component template when registering with framework alerts-as-data.
* Moved some common functions to alerting framework from the rule
registry
## Things to note
* When generating the ECS field map, we are now including the
`ignore_above` setting from the `@kbn/ecs` package. This changes the ECS
component template to include those settings. I tested updating an index
with just `"type":"keyword"` mappings to add the `ignore_above` field to
the mapping and had no issues so this seems like an additive change to
the mapping that will hopefully prevent problems in the future.
* The rule registry ECS component template also includes the technical
fields which is redundant because the technical component template is
automatically installed for all index templates so the framework ECS
component template only contains ECS fields.
| Previous mapping | Updated mapping |
| ----------- | ----------- |
| `{ "organization": { "type": "keyword" } }` | `{ "organization": {
"type": "keyword", "ignore_above": 1024 } }` |
## To Verify
### Verify that the generated component templates are as expected:
Get the following
**While running `main`:**
1. Get the ECS component template `GET
_component_template/.alerts-ecs-mappings`
2. Get the technical component template `GET
_component_template/.alerts-technical-mappings`
3. Create a detection rule that creates an alert and then get the index
mapping for the concrete security alert index `GET
.internal.alerts-security.alerts-default-000001/_mapping`
**While running this branch with `xpack.alerting.enableFrameworkAlerts:
false`:**
4. Get the ECS component template `GET
_component_template/.alerts-ecs-mappings`
5. Get the technical component template `GET
_component_template/.alerts-technical-mappings`
6. Create a detection rule that creates an alert and then get the index
mapping for the concrete security alert index `GET
.internal.alerts-security.alerts-default-000001/_mapping`
**While running this branch with `xpack.alerting.enableFrameworkAlerts:
true`:**
7. Get the ECS component template `GET
_component_template/.alerts-ecs-mappings`
8. Get the technical component template `GET
_component_template/.alerts-technical-mappings`
9. Create a detection rule that creates an alert and then get the index
mapping for the concrete security alert index `GET
.internal.alerts-security.alerts-default-000001/_mapping`
10. Verify that component templates exist for
`.alerts-framework-mappings` and `.alerts-legacy-alert-mappings`
**Compare the ECS component templates**
Compare 1 and 4 (ECS component template from `main` and installed by
rule registry in this branch). The difference should be:
* no difference in ECS fields
* because the rule registry ECS component template also includes
technical fields, you will see the 2 new technical fields in this branch
Compare 4 and 7 (ECS component template from rule registry & alerting
framework in this branch).
* some new ECS fields for alerting installed template
* each `keyword` mapped field for alerting installed template should
have `ignore_above` setting
* no `kibana.*` fields in the alerting installed template
**Compare the technical component templates**
Compare 2 and 5 (technical component template from `main` and installed
by rule registry in this branch). The difference should be:
* 2 new `kibana.alert` fields (`flapping_history` and `last_detected`)
Compare 5 and 8 (technical component template from rule registry &
alerting framework in this branch).
* there should be no difference!
**Compare the index mappings**
Compare 3 and 6 (index mapping from `main` and installed by rule
registry in this branch). The difference should be:
* 2 new `kibana.alert` fields (`flapping_history` and `last_detected`)
Compare 6 and 9 (index mapping from rule registry & alerting framework
in this branch).
* some new ECS fields
* each `keyword` mapped ECS field should have `ignore_above` setting
### Verify that the generated component templates work with existing
rule registry index templates & indices:
1. Run `main` or a previous version and create a rule that uses both ECS
component templates & technical component templates (detection rules use
both). Let it run a few times.
2. Using the same ES data, switch to this branch with
`xpack.alerting.enableFrameworkAlerts: false` and verify Kibana starts
with no rule registry errors and the rule continues to run as expected.
3. Using the same ES data, switch to this branch with
`xpack.alerting.enableFrameworkAlerts: true` and verify Kibana starts
with no alerting or rule registry errors and the rule continues to run
as expected. Verify that the mapping on the existing
`.internal.alerts-security.alerts-default-000001` has been updated to
include the latest ECS mappings and the two new technical fields.
### Checklist
Delete any items that are not applicable to this PR.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
## Summary
This PR contains the initial designs for our versioned router API. This
contribution contains only types, any implementation will come in later
PRs.
Previous PR https://github.com/elastic/kibana/pull/149943
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Ahmad Bamieh <ahmadbamieh@gmail.com>
After chatting with @KOTungseth, @scottybollinger, and @glitteringkatie
we've decided to add a CI step to the Kibana repo that will run when
changes to next-doc related code is made. This step will checkout the
repository containing configuration for the docs.elastic.dev website
(which is currently private, sorry) and then ensure that the build can
be completed with a local copy of all the repositories. It does this by
reading the `config/content.js` files and cloning all of the
repositories listed, then rewriting the content.js file with a map
telling the build system to read files from the local repos (which are
pre-cached by the packer cache job) and the local Kibana repo (which
represents the changes in the PR).
This script also runs locally by running `node
scripts/validate_next_docs`.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Fixes https://github.com/elastic/kibana/issues/149344
This PR migrates all plugins to packages automatically. It does this
using `node scripts/lint_packages` to automatically migrate
`kibana.json` files to `kibana.jsonc` files. By doing this automatically
we can simplify many build and testing procedures to only support
packages, and not both "packages" and "synthetic packages" (basically
pointers to plugins).
The majority of changes are in operations related code, so we'll be
having operations review this before marking it ready for review. The
vast majority of the code owners are simply pinged because we deleted
all `kibana.json` files and replaced them with `kibana.jsonc` files, so
we plan on leaving the PR ready-for-review for about 24 hours before
merging (after feature freeze), assuming we don't have any blockers
(especially from @elastic/kibana-core since there are a few core
specific changes, though the majority were handled in #149370).
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
# [Security Solution] Data Quality dashboard
## Check ECS compatibility with just one click
With just one click, the _Data Quality dashboard_ checks all the indices used by the Security Solution, (or anything else), for compatibility with the [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html)
## Create cases from results
Create a single case containing all the results, or create cases for specific indices
## Interactive tabs put results in context
Expand any index to reveal interactive tabs
- Summary
- Incompatible fields
- Custom fields
- ECS complaint fields
- All fields
## Share comprehensive markdown reports
Share markdown reports containing the same content as the dashboard
### On page load
When the Data Quality dashboard page loads, the alerts index, and any indices matching the selected `Data view` are displayed
Only `hot`, `warm`, or `unmanaged` indices are displayed by default
Indices are not checked automatically when the dashboard loads
Click either :
- `Check all` to check all the indices on the page
- The expand button to automatically check (just) one index, and instantly view results
### Check all
When the `Check all` button is clicked
- The `Check all` button changes to a `Cancel` button
- The `Last checked: n <time unit> ago` text is replaced with a progress bar indicating how many Indices are left to check
- The `Checking <index name>` text will update as each index is checked. Text will wrap if necessary
- The results tables begin updating with results
- Pattern stats update to summarize each table
- Rolled up results for the entire page update after every index is checked
<https://user-images.githubusercontent.com/4459398/216007795-2ebbc0c6-8c7a-49c7-a22c-b97d2a58dddd.mov>
When Check all, is running, the Data Quality dashboard adds a three second delay after every check completes, before beginning the next check.
Check all will keep checking indexes until the user cancels, or all indexes have (attempted to be) checked.
While Check all is running, users may simultaneously click on any index to check it on demand. The results are instantly rolled up when this happens.
When all checks complete, the page looks like this:
### Take action
Click the `Take action` popover to share the entire page of results via one of the following actions:
- Add to new case
- Copy to clipboard
### Expanding results
The `Incompatible fields` tab is always displayed by default when a result is expanded
The `Incompatible fields` tab shows a success message when a successful result is expanded
The `Incompatible fields` tab shows, side by side, expected ECS mapping types vs the actual mapping types when they are different
The `Incompatible fields` tab also compares field values expected by ECS vs the actual values in an index, when they are different
The `Incompatible fields` tab displays a callout that explains the consequences of having incompatible fields. The content is based on the following illustration, created by @MikePaquette
<img width="1264" alt="ecs_meter" src="https://user-images.githubusercontent.com/4459398/216016124-6fe89ab4-c364-40ec-8a6f-99349e6d583c.png">
The calllout has a call to action to create a case or copy a markdown report for just the expanded result
- Add to new case
- Copy to clipboard
### Tabs
The Summary tab displays a call to action when incompatible fields are found
Click on any part of the Summary tab chart or legend to navigate to the corresponding tab
Clicking on the `Copy to clipboard` call to action in the Custom fields tab copies a markdown version of the table to the clipboard
The search feature of the ECS complaint fields tab may, for example, be used to verify a specific ECS complaint mapping exists
The All fields tab displays the union of all other tabs
### Data view selection
The `Data view` dropdown defaults to the `Security Default Data View`
The alerts index is always checked and included in the results, even when another Data View is selected
### ILM phase options
Only `hot`, `warm`, or `unmanaged` indices may be selected for checking.
The `cold` and `frozen` options are disabled.
When all options in the `ILM phase` box are cleared, an informative empty prompt is displayed
### Errors
Errors may occur for some (or all) indices. The `View errors` button appears when the first error occurs
Users may click the `View errors` button to view them, even while a check is in progress
The Copy to clipboard button in the errors popover copies a markdown version of the errors table to the clipboard
When errors occur, the same content shown in the Errors popover is automatically included in the markdown report created by the `Take action` menu
### Markdown reports
The content of markdown reports (created by the Take action menu) includes most of the content from the Data Quality dashboard that created it
In the screenshot below, the Data Quality dashboard is on the left, and a markdown report (pasted into Github) is on the right
Stats rollups and tables are included in markdown reports
Markdown reports use the same "expected vs actual" format to display the details of incompatible field mappings
### Navigation
The Data Quality dashboard is grouped with the existing Security Solution dashboards
It may also be launched via the side navigation
## Privileges
The privileges in the table below are required to check any pattern of indices, or any specific index:
| Privilege | Required to | Required for API |
|-------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|------------------|
| `monitor` or `manage` (`manage` builds on `monitor`) | List indices that match a pattern, and get document counts for an index example: `GET logs-*/_stats` | `_stats` |
| `view_index_metadata` or `manage_ilm` | List index ILM configs (e.g. hot) that match a pattern example: `GET logs-*/_ilm/explain` | `_ilm/explain` |
| `view_index_metadata` or `manage` | Get index mappings for a specific index example: `GET .ds-logs-endpoint.events.process-default-2023.01.17-000001/_mapping` | `_mapping` |
| `read` or `read_cross_cluster` | Run aggregations to test for unallowed values example: `GET .ds-logs-endpoint.events.process-default-2023.01.17-000001/_search` | `_search` |
Users may have some of the privileges required to check an index, but not all of them.
The built-in `viewer` role does not have the `monitor` (or `manage`) role. The following screenshot illustrates what a user will see if they login as a user with the `viewer` role:
# An actual markdown report (all content below)
The rest of the content below is pasted from an actual report, created via the `Take action` menu:
# Data quality
| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 17 | 15 | 17 | 1,404,514 |
## .alerts-security.alerts-default
`hot(1)`
| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 1 | 1 | 1 | 1,837 |
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .internal.alerts-security.alerts-default-000001 | 1,837 (100.0%) | 1 | `hot` |
### .internal.alerts-security.alerts-default-000001
The `.internal.alerts-security.alerts-default-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .internal.alerts-security.alerts-default-000001 | 1,837 (100.0%) | 1 | `hot` |
### **Incompatible fields** `1` **Custom fields** `188` **ECS compliant fields** `1219` **All fields** `1408`
#### 1 incompatible field
Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.
❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported
#### Incompatible field values - .internal.alerts-security.alerts-default-000001
| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.category | `authentication`, `configuration`, `database`, `driver`, `email`, `file`, `host`, `iam`, `intrusion_detection`, `malware`, `network`, `package`, `process`, `registry`, `session`, `threat`, `vulnerability`, `web` | `behavior` (62) |
## auditbeat-*
`hot(11)` `unmanaged(1)`
| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 13 | 10 | 12 | 29,182 |
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.6.0-2023.01.17-000001 | 14,409 (49.4%) | 0 | `hot` |
| -- | .ds-auditbeat-8.5.3-2023.01.24-000001 | 2,857 (9.8%) | -- | `hot` |
| ✅ | .ds-auditbeat-8.2.3-2023.01.24-000001 | 2,246 (7.7%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.4.1-2023.01.24-000001 | 2,179 (7.5%) | 0 | `hot` |
| -- | .ds-auditbeat-8.3.3-2023.01.24-000001 | 1,921 (6.6%) | -- | `hot` |
| ✅ | auditbeat-7.16.0-2023.01.17-000001 | 1,880 (6.4%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.1.1-2023.01.24-000001 | 1,676 (5.7%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.2.2-2023.01.24-000001 | 1,578 (5.4%) | 0 | `hot` |
| ✅ | .ds-auditbeat-8.0.0-2023.01.24-000001 | 251 (0.9%) | 0 | `hot` |
| ❌ | auditbeat-7.10.2-2023.01.24-000001 | 111 (0.4%) | 12 | `hot` |
| ✅ | .ds-auditbeat-8.5.0-2023.01.24-000001 | 74 (0.3%) | 0 | `hot` |
| ❌ | auditbeat-custom-empty-index-1 | 0 (0.0%) | 1 | `unmanaged` |
### .ds-auditbeat-8.6.0-2023.01.17-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.6.0-2023.01.17-000001 | 14,409 (49.4%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `549` **ECS compliant fields** `1210` **All fields** `1759`
### .ds-auditbeat-8.2.3-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.2.3-2023.01.24-000001 | 2,246 (7.7%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1210` **All fields** `1720`
### .ds-auditbeat-8.4.1-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.4.1-2023.01.24-000001 | 2,179 (7.5%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `509` **ECS compliant fields** `1210` **All fields** `1719`
### auditbeat-7.16.0-2023.01.17-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | auditbeat-7.16.0-2023.01.17-000001 | 1,880 (6.4%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `523` **ECS compliant fields** `1111` **All fields** `1634`
### .ds-auditbeat-8.1.1-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.1.1-2023.01.24-000001 | 1,676 (5.7%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1204` **All fields** `1714`
### .ds-auditbeat-8.2.2-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.2.2-2023.01.24-000001 | 1,578 (5.4%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1210` **All fields** `1720`
### .ds-auditbeat-8.0.0-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.0.0-2023.01.24-000001 | 251 (0.9%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `510` **ECS compliant fields** `1204` **All fields** `1714`
### auditbeat-7.10.2-2023.01.24-000001
The `auditbeat-7.10.2-2023.01.24-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | auditbeat-7.10.2-2023.01.24-000001 | 111 (0.4%) | 12 | `hot` |
### **Incompatible fields** `12` **Custom fields** `467` **ECS compliant fields** `602` **All fields** `1081`
#### 12 incompatible fields
Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.
❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported
#### Incompatible field mappings - auditbeat-7.10.2-2023.01.24-000001
| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| error.message | `match_only_text` | `text` |
| error.stack_trace | `wildcard` | `keyword` |
| http.request.body.content | `wildcard` | `keyword` |
| http.response.body.content | `wildcard` | `keyword` |
| message | `match_only_text` | `text` |
| process.command_line | `wildcard` | `keyword` |
| process.parent.command_line | `wildcard` | `keyword` |
| registry.data.strings | `wildcard` | `keyword` |
| url.full | `wildcard` | `keyword` |
| url.original | `wildcard` | `keyword` |
| url.path | `wildcard` | `keyword` |
#### Incompatible field values - auditbeat-7.10.2-2023.01.24-000001
| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.kind | `alert`, `enrichment`, `event`, `metric`, `state`, `pipeline_error`, `signal` | `error` (1) |
### .ds-auditbeat-8.5.0-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-auditbeat-8.5.0-2023.01.24-000001 | 74 (0.3%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `509` **ECS compliant fields** `1210` **All fields** `1719`
### auditbeat-custom-empty-index-1
The `auditbeat-custom-empty-index-1` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | auditbeat-custom-empty-index-1 | 0 (0.0%) | 1 | `unmanaged` |
### **Incompatible fields** `1` **Custom fields** `0` **ECS compliant fields** `0` **All fields** `0`
#### 1 incompatible field
Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.
❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported
#### Incompatible field mappings - auditbeat-custom-empty-index-1
| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| @timestamp | `date` | `-` |
## logs-*
`hot(2)`
| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 3 | 2 | 2 | 602 |
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.alerts-default-2023.01.17-000001 | 342 (56.8%) | 2 | `hot` |
| ❌ | .ds-logs-endpoint.events.process-default-2023.01.17-000001 | 260 (43.2%) | 1 | `hot` |
### .ds-logs-endpoint.alerts-default-2023.01.17-000001
The `.ds-logs-endpoint.alerts-default-2023.01.17-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.alerts-default-2023.01.17-000001 | 342 (56.8%) | 2 | `hot` |
### **Incompatible fields** `2` **Custom fields** `857` **ECS compliant fields** `675` **All fields** `1534`
#### 2 incompatible fields
Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.
❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported
#### Incompatible field mappings - .ds-logs-endpoint.alerts-default-2023.01.17-000001
| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| process.env_vars | `keyword` | `object` |
#### Incompatible field values - .ds-logs-endpoint.alerts-default-2023.01.17-000001
| Field | ECS values (expected) | Document values (actual) |
|-------|-----------------------|--------------------------|
| event.category | `authentication`, `configuration`, `database`, `driver`, `email`, `file`, `host`, `iam`, `intrusion_detection`, `malware`, `network`, `package`, `process`, `registry`, `session`, `threat`, `vulnerability`, `web` | `behavior` (45) |
### .ds-logs-endpoint.events.process-default-2023.01.17-000001
The `.ds-logs-endpoint.events.process-default-2023.01.17-000001` index has [mappings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) or field values that are different than the [Elastic Common Schema](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html) (ECS), version `8.6.0` [definitions](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html).
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ❌ | .ds-logs-endpoint.events.process-default-2023.01.17-000001 | 260 (43.2%) | 1 | `hot` |
### **Incompatible fields** `1` **Custom fields** `130` **ECS compliant fields** `304` **All fields** `435`
#### 1 incompatible field
Fields are incompatible with ECS when index mappings, or the values of the fields in the index, don't conform to the Elastic Common Schema (ECS), version 8.6.0.
❌ Detection engine rules referencing these fields may not match them correctly
❌ Pages may not display some events or fields due to unexpected field mappings or values
❌ Mappings or field values that don't comply with ECS are not supported
#### Incompatible field mappings - .ds-logs-endpoint.events.process-default-2023.01.17-000001
| Field | ECS mapping type (expected) | Index mapping type (actual) |
|-------|-----------------------------|-----------------------------|
| process.env_vars | `keyword` | `object` |
## packetbeat-*
`hot(2)`
| Incompatible fields | Indices checked | Indices | Docs |
|---------------------|-----------------|---------|------|
| 0 | 2 | 2 | 1,372,893 |
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.6.0-2023.01.17-000001 | 704,062 (51.3%) | 0 | `hot` |
| ✅ | .ds-packetbeat-8.4.1-2023.01.24-000001 | 668,831 (48.7%) | 0 | `hot` |
### .ds-packetbeat-8.6.0-2023.01.17-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.6.0-2023.01.17-000001 | 704,062 (51.3%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `604` **ECS compliant fields** `1209` **All fields** `1813`
### .ds-packetbeat-8.4.1-2023.01.24-000001
| Result | Index | Docs | Incompatible fields | ILM Phase |
|--------|-------|------|---------------------|-----------|
| ✅ | .ds-packetbeat-8.4.1-2023.01.24-000001 | 668,831 (48.7%) | 0 | `hot` |
### **Incompatible fields** `0` **Custom fields** `604` **ECS compliant fields** `1209` **All fields** `1813`
## Errors
Some indices were not checked for Data Quality
Errors may occur when pattern or index metadata is temporarily unavailable, or because you don't have the privileges required for access
The following privileges are required to check an index:
- `monitor` or `manage`
- `view_index_metadata`
- `read` or `read_cross_cluster`
| Pattern | Index | Error |
|---------|-------|-------|
| .alerts-security.alerts-default | -- | `Error loading stats: Error: Forbidden` |
| auditbeat-* | -- | `Error loading stats: Error: Forbidden` |
| logs-* | -- | `Error loading stats: Error: Forbidden` |
| packetbeat-* | -- | `Error loading stats: Error: Forbidden` |
See also: https://github.com/elastic/security-team/issues/4559
## Summary
Fix https://github.com/elastic/kibana/issues/148412
More and more SO types will not be accessible from the HTTP APIs (either
`hidden:true` or `hiddenFromHTTPApis: true`).
However, the FTR SO client (`KbnClientSavedObjects`) still needs to be
able to access and manipulate all SO types.
This PR introduces a `ftrSoApis` plugin that is loaded for all FTR
suites. This plugin exposes SO APIs that are used by the FTR client
instead of the public SO HTTP APIs. These APIs are configured to know
about all types, even hidden ones.
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
We just had an issue where two PRs were merged and it caused the limit
of the `triggerActionsUi` bundle to be exceeded, breaking PR builds. The
issue is that we didn't see any indication of this in the on-merge jobs
because we don't produce the PR report for on-merge jobs or ask ci-stats
if we should fail the job. Instead, we just ship the metrics for
baseline purposes. This fixes that problem by adding a `--validate` flag
to `node scripts/ship_ci_stats`, which takes care of sending at least
some ci-stats and will verify that the bundle limits are not exceeded.
Since we didn't catch this issue in the on-merge job the limits were
incorrect for over an hour and merged into many PRs, wasting engineering
and CI time.
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Epic: https://github.com/elastic/kibana/issues/144943
## Summary
Moving the existing CellActions implementation to a new home. The
`kbn-cell-actions` package contains components and hooks that are going
to be used by solutions to show data cell actions with a consistent UI
across them.
Security Solution is going to start using it by migrating all
"hover-actions" to the unified implementation, but the usage is not
restricted to it. Any plugin can register and attach its own actions to
a trigger via uiActions, and use this package to render the CellActions
components in a consistent way.
The initial implementation was placed in the uiActions plugin itself due
to a types constraints
(https://github.com/elastic/kibana/tree/main/src/plugins/ui_actions/public/cell_actions),
the constraint has been solved so we are creating the package for it as
planned.
This PR only moves that implementation to the new package, with small
directory changes. The exported components are not being used anywhere
currently, so the implementation may change during the migration phase.
### Checklist
Delete any items that are not applicable to this PR.
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This PR ads a new cli package to allow us to search for package
locations by providing their IDs. I see this as useful as we start
adding more and more packages across different locations.
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
We're working on converting all plugins into packages, which turns
almost all code in the repository into a package except for things like
the `test` and `x-pack/test` directories. The problem we ran into is
that the alerting api-integration test plugins are being migrated to
packages but they are currently consuming a handful of helpers from the
parent `../lib` directory. This doesn't work, as packages can only
import other packages and the `../lib` directory isn't in a package,
it's just free-floating `x-pack/test` code. To fix this I've moved the
necessary components out of `common/lib` and into `packages/helpers`
which is importable via `@kbn/alerting-api-integration-helpers` and
updated all the uses to access this new package.
The location of plugins was previously somewhat irrelevant, but as we
move into packages it's more important that we can find all plugins in
the repository, and we would like to be able to do that without needing
to maintain a manifest somewhere to accomplish this. In order to make
this possible we plan to find any plugin/package by spotting all
kibana.json files which are not "fixtures". This allows plugin-like code
(but not actual plugin code) to exist for testing purposes, but it must
be within some form of "fixtures" directory, and any plugin that isn't
in a fixtures directory will be automatically pulled into the system
(though test plugins, examples, etc. will still only be loaded when the
plugin's path is passed via `--plugin-path`, the system will know about
them and use that knowledge for other things).
Since this is just a rename Operations will review and merge by EOD Jan
12th unless someone has a blocking concern.
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
- Moves duplicates of `DatePickerWrapper` and related code to package
`@kbn/ml-date-picker`. The duplicated components across the code base
have been consolidated and diverging features combined. Each duplicate
has been checked with a diff against the package before deletion.
- Moves duplicates of `query_utils.ts` to a package
`@kbn/ml-query_utils`.
- Some jest test were migrated from enzyme to react-testing-lib.
- `i18n` strings and data-test-subjects have been updated to be prefixes
in line with package names.
- Replaces custom code related to the `compact` flag with EUI's
breakpoints.
