kibana/x-pack/plugins/event_log/server
Gerard Soldevila 21351df953
Split the .kibana saved objects index into multiple indices (#154888)
## Description 

Fix https://github.com/elastic/kibana/issues/104081

This PR move some of the SO types from the `.kibana` index into the
following ones:
- `.kibana_alerting_cases`
- `.kibana_analytics`
- `.kibana_security_solution`
- `.kibana_ingest`

This split/reallocation will occur during the `8.8.0` Kibana upgrade
(*meaning: from any version older than `8.8.0` to any version greater or
equal to `8.8.0`*)

**This PR main changes are:**
- implement the changes required in the SO migration algorithm to
support this reallocation
- update the FTR tools (looking at you esArchiver) to support these new
indices
- update hardcoded references to `.kibana` and usage of the
`core.savedObjects.getKibanaIndex()` to use new APIs to target the
correct index/indices
- update FTR datasets, tests and utility accordingly 

## To reviewers

**Overall estimated risk of regressions: low**

But, still, please take the time to review changes in your code. The
parts of the production code that were the most impacted are the
telemetry collectors, as most of them were performing direct requests
against the `.kibana` index, so we had to adapt them. Most other
contributor-owned changes are in FTR tests and datasets.

If you think a type is misplaced (either we missed some types that
should be moved to a specific index, or some types were moved and
shouldn't have been) please tell us, and we'll fix the reallocation
either in this PR or in a follow-up.

## .Kibana split

The following new indices are introduced by this PR, with the following
SO types being moved to it. (any SO type not listed here will be staying
in its current index)

Note: The complete **_type => index_** breakdown is available in [this
spreadsheet](https://docs.google.com/spreadsheets/d/1b_MG_E_aBksZ4Vkd9cVayij1oBpdhvH4XC8NVlChiio/edit#gid=145920788).

#### `.kibana_alerting_cases`
- action
- action_task_params
- alert
- api_key_pending_invalidation
- cases
- cases-comments
- cases-configure
- cases-connector-mappings
- cases-telemetry
- cases-user-actions
- connector_token
- rules-settings
- maintenance-window

#### `.kibana_security_solution`
- csp-rule-template
- endpoint:user-artifact
- endpoint:user-artifact-manifest
- exception-list
- exception-list-agnostic
- osquery-manager-usage-metric
- osquery-pack
- osquery-pack-asset
- osquery-saved-query
- security-rule
- security-solution-signals-migration
- siem-detection-engine-rule-actions
- siem-ui-timeline
- siem-ui-timeline-note
- siem-ui-timeline-pinned-event

#### `.kibana_analytics`

- canvas-element
- canvas-workpad-template
- canvas-workpad
- dashboard
- graph-workspace
- index-pattern
- kql-telemetry
- lens
- lens-ui-telemetry
- map
- search
- search-session
- search-telemetry
- visualization

#### `.kibana_ingest`

- epm-packages
- epm-packages-assets
- fleet-fleet-server-host
- fleet-message-signing-keys
- fleet-preconfiguration-deletion-record
- fleet-proxy
- ingest_manager_settings
- ingest-agent-policies
- ingest-download-sources
- ingest-outputs
- ingest-package-policies

## Tasks / PRs

### Sub-PRs

**Implementation**
- 🟣 https://github.com/elastic/kibana/pull/154846
- 🟣 https://github.com/elastic/kibana/pull/154892
- 🟣 https://github.com/elastic/kibana/pull/154882
- 🟣 https://github.com/elastic/kibana/pull/154884
- 🟣 https://github.com/elastic/kibana/pull/155155

**Individual index split**
- 🟣 https://github.com/elastic/kibana/pull/154897
- 🟣 https://github.com/elastic/kibana/pull/155129
- 🟣 https://github.com/elastic/kibana/pull/155140
- 🟣 https://github.com/elastic/kibana/pull/155130

### Improvements / follow-ups 

- 👷🏼 Extract logic into
[runV2Migration](https://github.com/elastic/kibana/pull/154151#discussion_r1158470566)
@gsoldevila
- Make `getCurrentIndexTypesMap` resillient to intermittent failures
https://github.com/elastic/kibana/pull/154151#discussion_r1169289717
- 🚧 Build a more structured
[MigratorSynchronizer](https://github.com/elastic/kibana/pull/154151#discussion_r1158469918)
- 🟣 https://github.com/elastic/kibana/pull/155035
- 🟣 https://github.com/elastic/kibana/pull/155116
- 🟣 https://github.com/elastic/kibana/pull/155366
## Reallocation tweaks

Tweaks to the reallocation can be done after the initial merge, as long
as it's done before the public release of 8.8

- `url` should get back to `.kibana` (see
[comment](https://github.com/elastic/kibana/pull/154888#discussion_r1172317133))

## Release Note

For performance purposes, Kibana is now using more system indices to
store its internal data.

The following system indices will be created when upgrading to `8.8.0`:

- `.kibana_alerting_cases`
- `.kibana_analytics`
- `.kibana_security_solution`
- `.kibana_ingest`

---------

Co-authored-by: pgayvallet <pierre.gayvallet@elastic.co>
Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
2023-04-25 09:43:42 +02:00
..
es [packages] migrate all plugins to packages (#148130) 2023-02-08 21:06:50 -06:00
lib Cancel esAdapter.wait() on stop (#134727) 2022-06-28 09:30:59 +02:00
routes Removes deprecated <IHttpFetchError.res>, <IHttpFetchError.req> (#147727) 2022-12-27 10:55:21 -07:00
event_log_client.mock.ts [RAM] Allow users to see event logs from all spaces they have access to (#140449) 2022-10-31 17:26:53 -07:00
event_log_client.test.ts [ResponseOps][OnWeek] Connector logs view (#148291) 2023-01-23 15:33:01 -07:00
event_log_client.ts [ResponseOps][OnWeek] Connector logs view (#148291) 2023-01-23 15:33:01 -07:00
event_log_service.mock.ts [Alerting] Fixed Telemetry task: "Cannot read properties of undefined" due to the missing shard on Kibana start (#120438) 2021-12-14 10:12:43 -08:00
event_log_service.test.ts fix all violations 2022-04-16 01:37:30 -05:00
event_log_service.ts fix all violations 2022-04-16 01:37:30 -05:00
event_log_start_service.mock.ts Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
event_log_start_service.test.ts fix all violations 2022-04-16 01:37:30 -05:00
event_log_start_service.ts fix all violations 2022-04-16 01:37:30 -05:00
event_logger.mock.ts Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
event_logger.test.ts [Response Ops] Refactor alerting task runner - AlertingEventLog class (#131670) 2022-05-10 12:07:52 -04:00
event_logger.ts [Response Ops] Refactor alerting task runner - AlertingEventLog class (#131670) 2022-05-10 12:07:52 -04:00
index.ts Convert event log's duration from number to string in Kibana (keep as "long" in Elasticsearch) (#130819) 2022-05-03 11:54:10 -07:00
mocks.ts Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
plugin.test.ts fix all violations 2022-04-16 01:37:30 -05:00
plugin.ts Split the .kibana saved objects index into multiple indices (#154888) 2023-04-25 09:43:42 +02:00
saved_object_provider_registry.mock.ts [DX] Upgrade prettier to v2.4.0 (#112359) 2021-09-19 22:34:30 -07:00
saved_object_provider_registry.test.ts chore(NA): upgrades uuid to v9.0.0 (#149135) 2023-01-19 19:48:07 +00:00
saved_object_provider_registry.ts fix all violations 2022-04-16 01:37:30 -05:00
types.ts [ResponseOps][OnWeek] Connector logs view (#148291) 2023-01-23 15:33:01 -07:00