Commit graph

84939 commits

Author SHA1 Message Date
Maria Iriarte
4f9c54f91b
[Graph/SCSS] Migrate _venn_diagram.scss file to Emotion (#214962)
## Summary

Part of https://github.com/elastic/kibana/issues/208908

Replaces `_venn_diagram.scss` file to css-in-js .

## Screenshots

<img width="1593" alt="Screenshot 2025-03-18 at 12 50 55"
src="https://github.com/user-attachments/assets/f6685a78-15ce-4019-992a-9388efb79fab"
/>

<img width="1586" alt="Screenshot 2025-03-18 at 12 50 36"
src="https://github.com/user-attachments/assets/b1f57d53-509d-43c3-9a96-99ebacba35a1"
/>


### Checklist

- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-03-19 10:14:00 +01:00
Joe Reuter
856b222142
🌊 Streams: Link to streams in Discover (#214052)
Adding a link to the stream into the overview tab of the discover
document flyout:

<img width="228" alt="Screenshot 2025-03-12 at 08 57 48"
src="https://github.com/user-attachments/assets/dfd396e7-b0dc-4cca-a09c-637357cc88f9"
/>

Some reviewer notes:
* This is using the same strategy as the observability AI assistant via
the discover_shared registry - streams is not an observability-only
plugin, but for now we want to treat it like this. If we move closer to
this becoming a main feature, we can probably have discover depend on
streams directly
* For now, it's only showing the entry in the flyout if streams is
enabled so it's easy to test but doesn't show up accidentally. Before
the initial release, we can change this condition to always show for
observability spaces
* Resolving an index name to a data stream needs an Elasticsearch call
to get the index meta data. I created a new internal route for that. It
means that there is a loading state in theory, but in practice it should
resolve really quickly because it only hits the cluster state, not the
actual data.
* Even if no stream can be resolved it still shows the entry in the
flyout with a `-`. This is because it avoids shifting layout and it
doesn't seem to hurt if it's there.
* As I need to link to streams, I started introducing a locator - I'm
sure it will be needed more soon. I didn't add all the possible routes
yet, we can expand it as needed.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-03-19 10:56:07 +02:00
Marco Liberati
3c3038b855
[Lens] Hide fix action when in embeddable (#213414)
## Summary

Related to #177932
Inline editing introduced a blurred boundary for the editing experience
in Lens, while the full editor relies on a Redux state manager to
dispatch state changes the inline editor has an hybrid approach.
Specifically the `fixAction` feature in the user messages system needs
access to the redux store which is not available within the embeddable
environment as for now.
So with this PR I've currently limited the scope provided for those
message with a `fixAction` and won't render the button any more.

For instance while investigating #177932 I've noticed that now the
embeddable doesn't crash any more, but rather shows the error message
with the `fixAction` button:

<img width="1496" alt="Screenshot 2025-03-06 at 16 07 35"
src="https://github.com/user-attachments/assets/1b2a5d73-56d9-4010-8a6f-82528efcb2ce"
/>

Note that clicking on the `Use filters` nothing will happen as
d2412a5f98/x-pack/platform/plugins/shared/lens/public/react_embeddable/user_messages/api.ts (L195)
is a mock. A simple `updateAttributes` call here won't suffice as it
requires the logic behind `updateDatasourceState` slice to harmonize the
datasource changes with the visualisation counter part.
With this PR the message will hide the button and render as follow:

<img width="1498" alt="Screenshot 2025-03-06 at 16 18 55"
src="https://github.com/user-attachments/assets/01d55f6c-7563-4e07-a18e-35d1062a8d79"
/>

It is a temporary fix but at least it won't feel broken.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2025-03-19 09:55:34 +01:00
Kibana Machine
b731d759e8
[ES|QL] Update function metadata (#215087)
This PR updates the function definitions and inline docs based on the
latest metadata from Elasticsearch.
2025-03-19 10:50:05 +02:00
Kibana Machine
9ff3d6fd9b
[api-docs] 2025-03-19 Daily api_docs build (#215083)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/1016
2025-03-19 08:18:29 +02:00
Kerry Gallagher
f9783504bb
[Streams] [Dedicated Grok UI] Package / highlight matched parts / suggestions (#213278)
## Summary

Closes https://github.com/elastic/streams-program/issues/170 and
https://github.com/elastic/streams-program/issues/171

## Reviewer notes

It's worth reading the research in
https://github.com/elastic/streams-program/issues/168 to understand why
certain decisions were made. Some of the resolving code is inspired by
`grok-js`, unfortunately this wasn't something we could use directly.

The design / UX is **not** final. This is just a functional version. The
editor is currently on the streams > enrichment page so it can be played
with, this will **not** be merged.

There is pattern support for our ECS patterns, I have not added the
legacy ones.

There will almost certainly be some edge cases that don't work, every
repo for a Grok tool I looked at had their own 😅 I've tried to test this
with lots of varied examples though.

I'd recommend unticking "No extension" from the file filter to remove
the pattern files.

<img width="323" alt="Screenshot 2025-03-06 at 22 40 19"
src="https://github.com/user-attachments/assets/5b594f5f-0b0f-4ed0-ae10-2412fcf9e31a"
/>

## Possible improvements / followups

- We could in the future expand the UI to toggle on and off certain
pattern collections.

- Ability to add custom patterns (like in our Grok debugger). This can
still be achieved with `(?<queue_id>[0-9A-F]{10,11})` syntax.

- Point out when regex is invalid (right now it's silent).

- I've copied over the patterns from the ES repo for now, with a light
script to generate an object from them. There's a CLI skeleton in place
if we feel we want to actually pull these from the ES repo directly.
These patterns don't change often, and aren't heavy size wise.

- Debouncing etc for processing, but I'd like to see how the final UX
ends up.

## Media

Screenshot

![Screenshot 2025-03-06 at 11 58
56](https://github.com/user-attachments/assets/158b2a6f-df26-490e-b9f8-63ae69625607)

Simple example


![simple_example](https://github.com/user-attachments/assets/36f36505-eb0b-45d6-bd24-1dbef769658d)

Complex example


![complex_example](https://github.com/user-attachments/assets/968cc935-d208-4ef0-a64d-452995dccd5e)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-03-18 22:56:58 +00:00
Jon
ca04dbafd2
[package testing] Skip FTR (#215070)
The functional test run during package testing is currently erroring
post folder migration, but after fixing the path it's still not going to
match on any tests.

This temporarily disables the step while alternatives are considered.

Related to https://github.com/elastic/kibana/pull/214730 and
https://github.com/elastic/kibana/pull/210956
2025-03-18 16:33:50 -05:00
Hannah Mudge
edd9bf6896
[kbn-grid-layout] Fix bug when bulk moving panels to an empty row (#215024)
## Summary

We were not accounting for moving panels to an **empty** row in the
logic for `movePanelsToRow` - this resulted in a `maxRow` of `Infinity`,
which then caused the `grid-row-start` of all the panels to be
`Infinity`. This caused the following bug, because CSS grid does not
know how to handle `Infinity`:



https://github.com/user-attachments/assets/671112b9-ab96-4a1d-8589-e79bebd25292



By setting `maxRow` to zero when there are no panels in the destination
row, we now get the expected behaviour:




https://github.com/user-attachments/assets/7d4032e3-2699-47b0-847c-77af8f5f03ee



### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Identify risks

The row feature has not been released to customers, so risk is very low.
2025-03-18 14:25:23 -06:00
Dzmitry Lemechko
05447fe978
[scout] extend config-discovery with CI validator (#214403)
## Summary

More teams are adding Scout tests in their plugins, often as a PoC and
not stable yet for continuous execution.
We don't want to block it, but need a way to manage the scope of Scout
pipeline and be able to disable it quickly to unblock the Scout
development.

Since Scout is in active development and we need it to be simple and
quick as possible (we can iterate and improve later), we agreed with
Robert to disable tests by plugin:

```
ui_tests:
  enabled:
    - apm
    - discover_enhanced
    - maps
    - observability_onboarding
  disabled:
    - *skipped_plugin*
```

When scout configuration is added to the new plugin, it will require to
update `.buildkite/scout_ci_config.yml` that is owned by `appex-qa`
team. If there is no intention to run Scout tests on CI, plugin name
should be added under `disabled` section.

**How to test locally:**

- Scout tests were added in `observability_onboarding` plugin, pipeline
will throw error

modify locally `.buildkite/scout_ci_config.yml`
```
ui_tests:
  enabled:
    - apm
    - discover_enhanced
    - maps
  disabled:
```

run `node scripts/scout discover-playwright-configs --validate --save`

```
ERROR The following plugins are not registered in Scout CI config '.buildkite/scout_ci_config.yml'
      - observability_onboarding
```

~~On CI annotation will be added to clarify the failure:~~

we decided to move validation to "Quick Checks", no need to annotate.

<img width="1583" alt="image"
src="https://github.com/user-attachments/assets/ed6b5778-74cb-4473-8218-b96239aab067"
/>


- `observability_onboarding` plugin is disabled, pipeline won't include
it (excluded in `scout_playwright_configs.json`)

modify locally `.buildkite/scout_ci_config.yml`
```
ui_tests:
  enabled:
    - apm
    - discover_enhanced
    - maps
  disabled:
   - observability_onboarding
```

run `node scripts/scout discover-playwright-configs --validate --save`

```
 warn The following plugins are disabled in '.buildkite/scout_ci_config.yml' and will be excluded from CI run
      - observability_onboarding
 info Found Playwright config files in '4' plugins.
      Saved '3' plugins to '/Users/dmle/github/kibana/.scout/test_configs/scout_playwright_configs.json'
```
2025-03-18 21:24:54 +01:00
elastic-renovate-prod[bot]
ee906e67e2
Update docker.elastic.co/wolfi/chainguard-base:latest Docker digest to 5ba5def (main) (#214937)
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| docker.elastic.co/wolfi/chainguard-base | digest | `66d427a` ->
`5ba5def` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMDcuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEwNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOk9wZXJhdGlvbnMiLCJiYWNrcG9ydDpza2lwIiwicmVsZWFzZV9ub3RlOnNraXAiXX0=-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
2025-03-18 14:28:42 -05:00
Kibana Machine
681295ff9e
[ES|QL] Update grammars (#213006)
This PR updates the ES|QL grammars (lexer and parser) to match the
latest version in Elasticsearch.

---------

Co-authored-by: drewdaemon <drew.tate@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
2025-03-18 21:25:57 +02:00
Dominique Clarke
dfb16cbe46
[Chore] [Synthetics] Unskip previously flaky test (#214276)
## Summary

Fixes https://github.com/elastic/kibana/issues/196257
Fixes https://github.com/elastic/kibana/issues/202337

Unskip flaky test

Adjusted some assertions for more reliability. 

The final flaky test runner passed for 200 iterations.
2025-03-18 15:24:40 -04:00
Bailey Cash
0a10127efc
[SLO] add ability to select all services for apm slos (#214653)
## Summary

Resolves #212981

![Screenshot 2025-03-14 at 4 32
57 PM](https://github.com/user-attachments/assets/37ce3d96-1337-4106-91de-6de0f3057fee)

## Release Notes

Adds the ability to create an APM availability or latency SLO for all
services

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
2025-03-18 21:23:19 +02:00
Tiago Costa
1f3cbf1105
fix(NA): retrieve_elastic_doc tests helpers import (#215051)
This PR fixes https://github.com/elastic/kibana/pull/214880 as it
included a non existent import
2025-03-18 19:20:40 +00:00
Tiago Costa
003ff6514b
fix(NA): retrieve_elastic_doc tests helpers import 2025-03-18 19:15:27 +00:00
Lisa Cawley
3b2df8935b
[DOCS] Consolidate and clean up Kibana settings (part 1) (#214934) 2025-03-18 11:37:40 -07:00
Viduni Wickramarachchi
70e3a6096e
[Obs AI Assistant] Fix contextual insights scoring (#214259)
Closes https://github.com/elastic/kibana/issues/209572

### Summary

Scoring in contextual insights is broken because the
`get_contextual_insight_instructions` tool call is not followed by the
tool response. This happens because we replace the last user message (in
this case tool response) with the user message related to scoring.

### Solution

We should include the tool call name when replacing this message, so
that it gets converted to inference messages correctly here:

07012811b2/x-pack/platform/plugins/shared/observability_ai_assistant/common/convert_messages_for_inference.ts (L60-L81)


### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-03-18 14:37:21 -04:00
Tiago Costa
ca1f38a693
skip flaky suite (#194701) 2025-03-18 17:59:08 +00:00
Patryk Kopyciński
be777cf44f
[Security Assistant] Fix inference rollover (#214718)
## Summary
Fixes https://github.com/elastic/kibana/issues/214709#event-16799922233

The issue was caused by the rollover of the Knowledge Base Data stream
to use default inference endpoint.
During the rollover it first got to this branch
https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/elastic_assistant/server/ai_assistant_service/index.ts#L347-L369
where it went through all the steps and continued, but it didn't
override `this.knowledgeBaseStream`, so the next time someone hit API it
was going through this path calling `getInitializedResources` to make
sure all data streams were configured properly, but because we didn't
update `this.knowledgeBaseStream` it was failing, because the original
configuration that was created in service constructor was not called,
that's why it was returning an error
2025-03-18 19:47:45 +02:00
Elena Shostak
a3dd168cb1
Unauthorized route migration for routes owned by search-kibana (#214786)
### Authz API migration for unauthorized routes

This PR migrates last unauthorized routes owned by your team to a new
security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
```ts
router.get({
  path: '/api/path',
  ...
}, handler);
```

### **After migration:**
```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);
```
2025-03-18 18:29:08 +01:00
Lukas Olson
2de4b331d3
Fix sort for rollup data views (#214656)
## Summary

Resolves https://github.com/elastic/kibana/issues/213629.

Since https://github.com/elastic/kibana/pull/163784 we have included a
`format` parameter in the `sort` that we send to Elasticsearch. This
worked for everything except rollup data views, which break when the
`format` parameter is provided.

This restores the behavior prior to that PR (we still send the `sort`
but don't include the `format` parameter). Ideally we would probably not
send the timestamp field at all for rollup data views since we treat
them as if they are non-time-based, but this would require a bit of a
refactor, and rollups are deprecated anyway.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

### Release notes

Fixes opening a rollup data view in Discover.

Co-authored-by: Matthew Kime <matt@mattki.me>
2025-03-18 10:17:53 -07:00
Elena Shostak
a7cc00c4fe
Unauthorized route migration for routes owned by appex-sharedux (#214779)
### Authz API migration for unauthorized routes

This PR migrates last unauthorized routes owned by your team to a new
security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
```ts
router.get({
  path: '/api/path',
  ...
}, handler);
```

### **After migration:**
```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);
```
2025-03-18 18:00:53 +01:00
Joe Reuter
df55627b2d
Fix special click behavior in new side nav (#214650)
Not sure whether we have an issue for is, but a problem I constantly run
into is that cmd+click to open in new tab doesn't work with the new side
nav. You need to do right click + open in new tab which is taking at
least 3 times as long.

This is a problem because it's not the expected behavior - the entries
in the nav are regular links and they should behave like that (the old
nav didn't have this problem).

This PR fixes the issue to not call `e.preventDefault()` in case it's a
"special click" and only triggers the in-page navigation in cases where
the user does a normal left click.

Co-authored-by: Bhavya RM <bhavya@elastic.co>
2025-03-18 17:06:58 +01:00
Elena Shostak
b9d240b38b
Unauthorized route migration for routes owned by kibana-core (#214780)
### Authz API migration for unauthorized routes

This PR migrates last unauthorized routes owned by your team to a new
security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
```ts
router.get({
  path: '/api/path',
  ...
}, handler);
```

### **After migration:**
```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);
```
2025-03-18 17:04:01 +01:00
Bryce Buchanan
caaea10fb9
Update i18n README.md (#214828)
Link to i18n tools link was broken.

Co-authored-by: Jean-Louis Leysens <jeanlouis.leysens@elastic.co>
2025-03-18 09:02:33 -07:00
Pablo Machado
6ab5523a28
[SecuritySolution] Add index privileges check to applyDataViewIndices (#214803)
## Summary

Add a new privileges check before executing `applyDataViewIndices`.

This change impacts the API call `applyDataViewIndices` and the job. 
`applyDataViewIndices` updates the transforms. Executing without
privileges generates a silence error because the transform can't run.

I also added some extra unit tests for `applyDataViewIndices`.

Required privileges
['read', 'view_index_metadata'] for all security solution dataview +
asset_criticality and risk_score indices.


### How to test it
1. **API call with unprivileged user scenario**
* Enable the entity store with a superuser
* Create an unprivileged user
* Call `POST kbn:api/entity_store/engines/apply_dataview_indices`
* It should return an error
* Add the required privileges
* It executes successfully

2. **Task execution with an unprivileged user scenario**
* Create a user and add privileges only for the required Entity Store
indices
* Login with the new user
* Enable the entity store
* Add a new index to the security data view (the new user shouldn't have
access to the new index)
* Wait for 30min for the job to run, or update the [source
code](8d0feb580f/x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/tasks/data_view_refresh/data_view_refresh_task.ts (L150))
to make it run more often
* The job execution should fail with an error message containing the new
index name.




### Checklist

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2025-03-18 17:37:39 +02:00
Devon Thomson
9238626606
[kbn-grid-layout] Smoother scrolling (#214512)
Use `requestAnimationFrame` to make the autoscroll functionality match the refresh rate of the display.
2025-03-18 11:27:05 -04:00
James Gowdy
561151dfbb
[ML] File upload minor design changes (#214539)
Design changes based on
[this](https://github.com/elastic/kibana/pull/213525#pullrequestreview-2684013527)
comment.

Places preview limit information into a callout.
Removes the "Create new index" title.
Removes mention of ingest pipeline during upload steps.
Also includes a fix for the preview of pdf files.


![image](https://github.com/user-attachments/assets/dbd25c54-032c-4596-9973-d4cd01cde364)
2025-03-18 15:26:03 +00:00
Efe Gürkan YALAMAN
a73477c7c0
Add FTR cases for synonyms (#214476)
## Summary

Adds more coverage for FTRs to test Synonyms UI in serverless.

Adds test cases for synonyms set listing, synoyms set detail and adding
deleting rules.
Covers some happy paths.


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-03-18 17:25:48 +02:00
James Gowdy
d10e1f8f17
[ML] Fixes chart in single metric anomaly detection wizard (#214837)
Fixes an issue with the single metric wizard chart where an error is
thrown when attempting to adjust the buckets of the previous batch of
loaded results.

**Before**


![image](https://github.com/user-attachments/assets/ac9feef5-f354-4423-b34d-39afc029f024)

![image](https://github.com/user-attachments/assets/7d62db99-e7d9-4a08-a823-fa4a4a5e79af)



**After**

![image](https://github.com/user-attachments/assets/a3d9c3fd-3eac-4b82-b9d6-319735258661)
2025-03-18 15:25:31 +00:00
Arturo Lidueña
8241bd7e6c
add API retrieve_elastic_doc tests (#214880)
Related: https://github.com/elastic/kibana/issues/180787

- Adds test for `retrieve_elastic_doc` function
2025-03-18 15:45:43 +01:00
Bailey Cash
56f1ebfca6
[SLO] Check for unique SLO ids across spaces (#214496)
## Summary 
Resolves #212784 
Ensure that when an SLO is created, the id is verified across all
spaces.

## Release Notes
Ensure that when an SLO is created, the id is verified across all
spaces.

## Testing
1. Create an SLO and save the id returned in the response in a space "A"
2. Create a second SLO with the id saved from the first SLO in the
request in a different space "B"
3. User should receive a 409 error from the SLO API.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-03-18 10:44:58 -04:00
Viduni Wickramarachchi
69e8dcf59b
[Obs AI Assistant] Fix KB bulk import UI example (#214970)
Closes https://github.com/elastic/kibana/issues/214849

## Summary

The KB bulk import UI example has a missing property `title`.
This PR adds the missing property so that the users know which format is
expected when bulk importing.


![image](https://github.com/user-attachments/assets/38466e7d-d87d-4680-8675-327237357999)

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-03-18 10:34:21 -04:00
Jacek Kolezynski
237d4f5c14
[Security Solution] Fix flaky test for delete rules bulk legacy and unskip it (#214724)
**Resolves: #214633**

## Summary

I am fixing a flaky test in the `delete_rules_bulk_legacy.ts` file
introduced in the #213244.

Also, in two other files I am changing using expect from kbn to jest.
2025-03-18 15:01:53 +01:00
Bena Kansara
48124058e3
[Observability] [Alert] Add context.grouping action variable in Custom threshold and APM rules (#212895)
Partially resolves https://github.com/elastic/kibana/issues/180709

Adds `context.grouping` action variable in the following rules:
- Custom threshold rule
- APM Latency threshold rule
- APM Failed transaction rate rule
- APM Error count rule

I will open a follow up PR to add `context.grouping` action variable in
the following rules:
- Elasticsearch query rule
- SLO burn rate rule

Excluded from scope:
- Metric threshold rule (already has `context.groupByKeys`)
- Log threshold rule (already has `context.groupByKeys`)
- Inventory threshold rule (already has `context.group` and this rule
doesn't have explicit group by fields)

### Testing
1. Create each rule with group by fields, and with "active" and
"recovered" actions
3. In "active" and "recovered" action message, use `context.grouping`
variable
4. Ensure that both "active" and "recovered" alert notifications contain
correct information
5. Ensure that the action variables UI in rule form shows
`context.grouping` action variable

Example of action message for APM Latency threshold rule with group by
on `transaction.name`:

```
{
  "grouping": "{{context.grouping}}",
  "service.name": "{{context.grouping.service.name}}",
  "service.environment": "{{context.grouping.service.environment}}",
  "transaction.type": "{{context.grouping.transaction.type}}",
  "transaction.name": "{{context.grouping.transaction.name}}"
}
```

Example of action message for Custom threshold rule with group by on
`host.name` and `container.id`:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```

---------

Co-authored-by: Maryam Saeidi <maryam.saeidi@elastic.co>
2025-03-18 13:46:17 +01:00
Justin Kambic
a412a05ddf
[Uptime] Unskip flaky Overview Page tests (#214807)
## Summary

Resolves #57737.
Resolves [#89072](https://github.com/elastic/kibana/issues/89072).

40/40 
[run](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8051)
on Flaky Test Runner.

- [Example #57737
success](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8051#0195a4d4-f2d0-4be4-a91d-6b0d4b6ba84d/240-1226)
- [Example #89072
success](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8051#0195a4d4-f2d0-4be4-a91d-6b0d4b6ba84d/240-1231)

Using the page elements manually on the test server version of Kibana, I
can click through and execute all these tests by hand. However, for some
reason web driver does not click the elements and make the desired
things happen.

All of the behaviors we are testing are configurable via the URL params,
so I'm relying on the URL to set the app state to the expected
conditions to verify the app is working. These page elements are also
tested via unit-level tests, so I don't think we are losing any
practical coverage for this soon-to-be-deprecated code.

Additionally, I removed the code in the `beforeEach` hook that utilizes
the date picker to set the default start/end range fields. This takes
_forever_, and our tests don't need to test that `SuperDatePicker` is
doing its job (again, our implementation has unit tests to verify the
correct callbacks are provided and that they handle the input criteria).
Instead we simply `navigateToApp` with the default parameters specified
in the URL search.
2025-03-18 08:39:58 -04:00
Saarika Bhasi
c5a8fcb69d
[Onboarding] Stack - update index management breadcrumbs (#209599)
## Summary 

**Requirement:** 
In stack and when its search solution space, we need to update search
index details breadcrumbs, when navigated via Content -> Index
Management :

- Index management list page - `Content / Index Management / Indices`
- Index list page -` Content / Index Management / indices /
<index_name>`
- drop `Stack management` from the breadcrumb 

In Classic nav, index management index details page breadcrumbs will
have no change in UI. But index management app is rendered from
search_indices plugin

### Solutions

Currently, Index management app is rendered from
[management_app](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/management/public/components/management_app/management_app.tsx).
The management app sets breadcrumbs for all the dependant apps. The
easiest way to implement is to set breadcrumbs based on active solution
type - `es` but this would alter breadcrumbs when index management app
is rendered from side nav footer ( management -> index management) and
other related management apps as well.

Other options is to modify setBreadcrumbs in
[ManagementAppMountParams](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/management/public/types.ts#L79)
but the setBreadcrumbs is used by multiple other apps.

In this PR, index management app is mounted via search indices plugin.
In this way we can customize breadcrumbs for index management when
rendered from search_indices plugin. When its search solution type,
index management app will work independently from management app.


### Screenshots

#### Search solution Nav - Changed breadcrumb ( dropped stack management
& added index name)
<img width="1727" alt="Screenshot 2025-02-04 at 1 29 08 PM"
src="https://github.com/user-attachments/assets/bc6f733f-62f4-44bc-8373-24d92719f5df"
/>


#### Serverless 
**Note:** No change in functionality from this PR. Added for additional
info

index details page breadcrumbs should be `Data/ Index Management /
Indices/<index_name>`
index list page breadcrumbs should be `Data/ Index Management /
Indices/`

**Serverless Details page**
<img width="1727" alt="Screenshot 2025-02-04 at 1 23 14 PM"
src="https://github.com/user-attachments/assets/72bac7a8-d7d1-40fc-9c73-bbd0545dba1f"
/>

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-03-18 08:37:21 -04:00
Dario Gieselaar
70f1880e4f
[Inference] Inference CLI client (#214691)
Exposes an Inference (plugin) API client for scripts, that mimicks the
`chatComplete` and `output` APIs that are available on its start
contract. It depends on the KibanaClient that is exposed from the
`@kbn/kibana-api-cli` package. It automatically selects a connector if
available.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-03-18 13:33:30 +01:00
Lisa Cawley
863a42fd31
[DOCS] Add minimal short URL APIs (#213860) 2025-03-18 14:28:23 +02:00
Drew Tate
74c31fbc86
[ES|QL] Separate EVAL autocomplete routine (#212996)
## Summary

Part of https://github.com/elastic/kibana/issues/195418

Gives `EVAL` autocomplete logic its own home 🏡


### Expression suggestions function

This PR also introduces a semi-generic function for generating
suggestions within an expression. This is so that the logic can be
shared between `EVAL` and `WHERE`. It also gets us closer to supporting
filtering in `STATS` (https://github.com/elastic/kibana/issues/195363).

To make this happen, I took stock of where we have differences in our
expression suggestions between `WHERE` and `EVAL`. In some cases, the
differences seemed important. In other cases, I felt ok removing them.

#### EVAL

| Behavior | Plan |

|--------------------------------------------------------------------------|------|
| Suggests pipe and comma after complete column names (`column/` or
`column /`)| get rid of it because an expression consisting of just a
single column name is essentially useless in `EVAL` |
| Doesn't suggest fields after an assignment | get rid of it. why act
any different than an expression not assigned an alias? |
| Suggests assignment operator after new column name (`newColumn /`) |
keep it |
| Suggests assignment snippet for empty expression | keep it |
| Suggests time literal completions after literal number in assignment
(`newColumn = 1 /`) | remove it. it doesn't feel that useful and
removing it makes it easier to have a generic expression suggestions
function. It will still be around in functions and operators (e.g. `1
day + 2 /`). |
| Supports multiple expressions | keep it |

#### WHERE

| Behavior | Plan |

|--------------------------------------------------------------------------|------|
| Suggests pipe after complete boolean expression (`foo AND bar /`) |
keep it, but outside of the expression suggestion function |
| Suggests boolean operators to make a boolean expression (`timestamp >
"2002" AND doubleField /`) | keep it... maybe we're being too smart but
we can always remove it later |

### Other changes
- the suggestions for `CASE(foo != /)` used to differ based on the
trigger kind. This seemed inadvertent so I removed the difference.
- we now add spaces after fields that are inserted in expressions. E.g.
`WHERE foo + <insert field><space>`. I'm not sure if this is best or
not...


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### Identify risks

- [ ] As with any refactor, there's a possibility this will introduce a
regression in the behavior of commands. However, all automated tests are
passing and I have tested the behavior manually and can detect no
regression.

---------

Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-03-18 06:24:50 -06:00
Kevin Lacabane
e84f6de3f6
[streams] content packs endpoints (#213910)
Creates basic routes to download and upload content packs associated to
a stream.
Only dashboard assets will be exported and linked to a stream.

The endpoints are currently a proxy to the savedObjects
importer/exporter interfaces:
- download exports the dashboard linked to a stream
- upload imports a content pack file and link the dashboards to the
targeted stream. Dashboards are imported as-is with no index pattern
replacement performed, this will be implemented separately

### Testing
- download `curl -XPOST -H "x-elastic-internal-origin: 'kibana'" -H
"kbn-xsrf: true"
http://elastic:changeme@localhost:5601/pat/api/streams/logs/content/export
--output content.json`
- upload `curl -XPOST -H "kbn-xsrf: true"
http://elastic:changeme@localhost:5601/pat/api/streams/logs.foo/content/import
-F 'content=@content.json'`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-03-18 14:22:18 +02:00
Sergi Romeu
e1f094d1f5
[APM] Filter out upstream orphans in waterfall (#214704)
## Summary

Closes #212797


This PR filters out upstream orphans in the waterfall, which was
confusing as we were reparenting to the entry transaction.
2025-03-18 14:06:36 +02:00
Ellie
23bc38679b
Update kibana-chrome-forward-testing.yml (#214961)
Fix format (see
[error](https://buildkite.com/elastic/detect-invalid-rre-pipeline/builds/684#0195a90e-29c0-42bc-a2f8-39febedf462c/83-177))
2025-03-18 13:02:41 +01:00
Gerard Soldevila
06d36983a7
Restore files lost during relocation of src/platform/test (#214920)
## Summary

These files were lost (not added during the relocation) due to outdated
`.gitignore` config.
2025-03-18 12:53:22 +01:00
Dzmitry Lemechko
48cd2075f7
[scout] add 'apiServices' fixture to group Kibana API helpers (#214470)
## Summary

We decided to group `Kibana API helpers` under a single fixture:
`apiServices` instead of individual fixtures. It should simplify the
search of existing helpers and reduce a risk for Teams to create the
same helper like we see today with FTR.
Adding just `apiServices` in test context and adding dot will expand a
list of all available API helpers + it can be extended for individual
solution (e.g. @kbn/scout-oblt) and directly in plugin (if there is no
chance to re-use it in other plugins)

<img width="699" alt="image"
src="https://github.com/user-attachments/assets/34a76659-04af-48c4-ab69-abda0c950206"
/>


Before:

```
test('should create something', async ({
      fleetApi,
      onboardingApi,
      alertingApi,
    }) => {
      await fleetApi.integration.install(integrationName);
      await onboardingApi.updateInstallationStepStatus(
        onboardingId,
        'ea-download',
        'complete'
      );
      await alertingApi.waitForAlert(alertId);
```

After:

```
test('should create something', async ({
      apiServices,
    }) => {
      await apiServices.fleet.integration.install(integrationName);
      await apiServices.onboarding.updateInstallationStepStatus(
        onboardingId,
        'ea-download',
        'complete'
      );
      await apiServices.alerting.waitForAlert(alertId);
```
2025-03-18 13:34:25 +02:00
Konrad Szwarc
9a179d7fd6
[EDR Workflows] Defend Insights - Evaluation (#213959)
This PR introduces evaluation functionality to Defend Insights, enabling
us to trigger LangSmith experiments directly from Kibana.
Additionally, we’ve migrated to the new prompt storage system used in
Attack Discovery (see commit bcbb12b732).
2025-03-18 13:28:49 +02:00
Ievgen Sorokopud
3f0f461d4e
[Attack Discovery][Scheduling] Add tabs to Attack Discovery settings flyout (#12007) (#214808)
## Summary

Main ticket ([internal
link](https://github.com/elastic/security-team/issues/12007))
Filgma link: ([internal
link](https://www.figma.com/design/1AEgYCsQjCsWxAKoErYfL3/9.1-%5BAttack-Discovery%5D-Scheduling-%26-notifications?node-id=3421-195207&t=Y9ejBkDCojHD95qw-4))

With these changes we introduce tabs in Attack Discovery settings
flyout: Settings and Schedule.

## Settings tab

Settings tab contains all current filtering settings applied to the
manually triggered Attack Discovery generations.

<img width="643" alt="Screenshot 2025-03-17 at 16 46 09"
src="https://github.com/user-attachments/assets/4b43f304-2c73-497a-8112-d024a6b04623"
/>

## Schedule tab

Schedule tab will have Attack Discovery scheduling rules management. As
a first step it shows empty state with no existing schedules and the
"Create" button.

<img width="645" alt="Screenshot 2025-03-17 at 16 45 57"
src="https://github.com/user-attachments/assets/f8a952b3-452f-4281-b41a-18a5023440f3"
/>

## NOTES

The feature is hidden behind the feature flag:

> xpack.securitySolution.enableExperimental:
['assistantAttackDiscoverySchedulingEnabled']

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2025-03-18 12:20:19 +01:00
Alex Szabo
1c6f8bed0b
[ci] Disable chrome forward testing until 2025-03-28 (#214947)
## Summary
The chrome forward-testing pipeline highlights upcoming errors in next
chrome versions:
https://buildkite.com/elastic/kibana-chrome-forward-testing

It's currently broken since chrome-beta was updated to 135. Chrome 135
will drop to main line on [April 1st.
](https://chromiumdash.appspot.com/schedule)

Revert this by 2025-03-28, or if
https://github.com/elastic/kibana/issues/213919 is finished.
2025-03-18 11:59:18 +01:00
Alex Szabo
702c9c49dc
[CI] Only emit .d.ts when running typecheck (#209259)
## Summary
Stop emitting any `.js` files during typechecking. We only depend on the
declarations, not the emitted, compiled javascript files.

An added benefit, is making some bad import errors more obvious.  
We'll no longer try to build javascript files in place if a poor
import/require is made, rather the error of importing outside projects
(in the forest of a bunch of errors possibly) will be visible in the
typescript logs:
```
# instead of:
proc [tsc] error TS5055: Cannot write file '/opt/buildkite-agent/builds/bk-agent-prod-gcp-1741789017236110254/elastic/kibana-pull-request/kibana/src/platform/packages/shared/kbn-babel-register/cache/no_cache_cache.js' because it would overwrite input file.

# we'll see:
... several others like this
 proc [tsc] src/platform/packages/shared/kbn-grok-ui/scripts/generate_patterns.js:10:9 - error TS6307: File '/Users/alex/Git/elastic-kibana/src/setup_node_env/index.js' is not listed within the file list of project '/Users/alex/Git/elastic-kibana/src/platform/packages/shared/kbn-grok-ui/tsconfig.type_check.json'. Projects must list all files or use an 'include' pattern.
 proc [tsc] 
 proc [tsc] 10 require('../../../../../setup_node_env');
... several others like this
```
2025-03-18 11:48:14 +01:00
elastic-vault-github-plugin-prod[bot]
53970f276c
[main] Sync bundled packages with Package Storage (#214911)
Automated by
https://buildkite.com/elastic/package-storage-infra-kibana-discover-release-branches/builds/2460

Co-authored-by: elasticmachine <elasticmachine@elastic.co>
2025-03-18 10:39:14 +00:00