kibana/x-pack/plugins
Milton Hultgren 66e3f08c1d
[EEM] Remove duplicates from latest data set (#187699)
By only grouping on `entity.id` we should be able to remove duplicates
in the latest indices.
This PR also removes the values found for `entity.identityFields` and
replaces it with a list of those field names.
This PR also lifts the values for the identity fields to the root of the
document.
This PR removes the `displayName` from the historical documents.

### How to test

Source data:
```
PUT index_a
{
  "mappings": {
    "properties": {
      "a": {
        "type": "keyword"
      },
      "@timestamp": {
        "type": "date"
      }
    }
  }
}

PUT index_b
{
  "mappings": {
    "properties": {
      "b": {
        "type": "keyword"
      },
      "@timestamp": {
        "type": "date"
      }
    }
  }
}

POST index_a/_doc
{
  "a": "same",
  "@timestamp": "2024-07-05T12:33:06.162Z"
}

POST index_b/_doc
{
  "b": "same",
  "@timestamp": "2024-07-05T12:33:06.162Z"
}
```

Entity definition:
```
POST kbn:/internal/api/entities/definition
{
  "id": "bucket_key",
  "name": "Bucket key",
  "type": "service",
  "indexPatterns": [
    "index_*"
  ],
  "timestampField": "@timestamp",
  "lookback": "5m",
  "identityFields": [
    {
      "field": "a",
      "optional": true
    },
    {
      "field": "b",
      "optional": true
    }
  ],
  "displayNameTemplate": "{{a}}{{b}}",
  "history": {
    "timestampField": "@timestamp",
    "interval": "5m"
  }
}
```

### Change in the format of the resulting documents
```
"identityFields": {
  "a": null,
  "b": "same"
},
```
=>
```
"identityFields": [
  "a",
  "b"
],
```
2024-07-12 16:59:18 +02:00
..
actions [Security Solution][Endpoint] Add kill-process API support for SentinelOne agents (#186133) 2024-07-09 14:26:44 +02:00
aiops [ML] Hide ML embeddables from the "Add panel" flyout when ML feature isn't available (#187639) 2024-07-09 22:21:20 +10:00
alerting [Response Ops][Alerting] Deleting ad hoc run task if the last schedule entry ends in a timeout (#187496) 2024-07-08 20:07:57 -04:00
banners
canvas Redesign the "Add Panel" Experience (#183764) 2024-06-26 13:55:28 -07:00
cases [ResponseOps][Cases] Fix template's custom fields bugs (#187591) 2024-07-11 17:13:19 +01:00
cloud [EBT] Combine packages (#186048) 2024-06-18 14:23:16 +02:00
cloud_defend [Cloud Defend Plugin] Migrate authc.getCurrentUser usage to core.security (#187023) 2024-07-01 19:30:05 -05:00
cloud_integrations [Security-in-core] Cloud Chat (#187306) 2024-07-03 03:19:26 -05:00
cloud_security_posture [Cloud Security] Fix GCP single account msg typo (#188113) 2024-07-11 20:07:54 +03:00
cross_cluster_replication [Kibana Management] Add a limit when strings are too long (#186312) 2024-06-27 14:46:54 +02:00
custom_branding
dashboard_enhanced [i18n] Fix broken i18n messages (#185011) 2024-06-07 14:19:46 -06:00
data_quality [Logs Explorer] Add logic to render degraded fields table in Logs Flyout (#186287) 2024-07-09 12:27:45 +02:00
data_visualizer [ES|QL] Rename text-based-languages pugin to esql plugin (#187520) 2024-07-10 00:16:32 +10:00
discover_enhanced
drilldowns
ecs_data_quality_dashboard [Security Solution][DQD] Persist new fields in results storage (#185025) 2024-06-13 11:14:48 +02:00
elastic_assistant [Security GenAI] Use AI setting to set langsmith tracing to the Integration Assistant (#187466) 2024-07-08 20:14:57 +02:00
embeddable_enhanced [dashboard] fix Upgraded dashboard with image embeddable shows 'unsaved changes' badge when opening editor (#183539) 2024-05-15 13:22:24 -06:00
encrypted_saved_objects [ESO Plugin] Migrate authc.getCurrentUser usage to coreStart.security (#187024) 2024-07-08 20:27:24 -07:00
enterprise_search [Semantic text] Make semantic text work with non-root level fields (#187154) 2024-07-11 20:35:56 +10:00
event_log [Kibana logging system] Add conditional evaluation based on level for logging APIs (#187225) 2024-07-08 23:53:02 +10:00
features Add support for a declarative (via configuration) way to specify Kibana feature overrides (#180362) 2024-06-06 15:55:19 +02:00
fields_metadata [Spacetime] Fields metadata services (#183806) 2024-06-05 09:51:50 +02:00
file_upload [i18n][system upgrade] Upgrade Intl Packages from v2 to v6 (#179506) 2024-06-02 16:50:33 +03:00
fleet [Fleet] Avoid loading package saved objects into memory before deleting them (#188004) 2024-07-12 13:05:51 +02:00
global_search
global_search_bar [Global Search] Limit characters for global search bar (#186560) 2024-07-11 07:50:20 -07:00
global_search_providers [Lens] [Unified Search] [Dashboards] [Maps] fuzzy search for field pickers and field lists (#186894) 2024-07-10 17:48:25 +02:00
graph [AppEx-SharedUX] Remove toMountPoint parameter from TableListViewKibanaProvider (#182030) 2024-04-30 11:14:48 -07:00
grokdebugger [Mgmt] Remove usage of deprecated modules for mounting React, Part II (#182043) 2024-05-07 08:59:44 -07:00
index_lifecycle_management [ILM] Add unsaved change prompt to create/edit form (#186837) 2024-06-27 14:10:45 -04:00
index_management [Semantic text] Make semantic text work with non-root level fields (#187154) 2024-07-11 20:35:56 +10:00
ingest_pipelines [ILM] Add unsaved change prompt to create/edit form (#186837) 2024-06-27 14:10:45 -04:00
integration_assistant [Integration Assistant] Implement unit tests for the UI (#187590) 2024-07-11 15:43:31 +01:00
kubernetes_security [i18n][system upgrade] Upgrade Intl Packages from v2 to v6 (#179506) 2024-06-02 16:50:33 +03:00
lens [ES|QL] Rename text-based-languages pugin to esql plugin (#187520) 2024-07-10 00:16:32 +10:00
license_api_guard Add @typescript-eslint/no-floating-promises (#181456) 2024-05-01 08:41:31 -07:00
license_management Upgrade EUI to v95.2.0 (#186841) 2024-06-28 17:37:58 -05:00
licensing [licensing] Log a warning when fetching a missing license (#187942) 2024-07-11 12:03:19 +02:00
lists [Lists Plugin] Migrate authc.getCurrentUser usage to coreContext.secu… (#187179) 2024-07-02 08:33:12 -07:00
logstash [Logstash Plugin] Migrate authc.getCurrentUser usage to coreContext.security (#187180) 2024-07-04 03:39:37 +10:00
maps [ES|QL] Rename text-based-languages pugin to esql plugin (#187520) 2024-07-10 00:16:32 +10:00
ml [Semantic text] Make semantic text work with non-root level fields (#187154) 2024-07-11 20:35:56 +10:00
monitoring Fix typo in stack monitoring apm (#187875) 2024-07-10 14:50:47 +01:00
monitoring_collection [Monitoring] Set explicit access option for internal API (#186882) 2024-06-26 11:50:54 +02:00
notifications Add @typescript-eslint/no-floating-promises (#181456) 2024-05-01 08:41:31 -07:00
observability_solution [EEM] Remove duplicates from latest data set (#187699) 2024-07-12 16:59:18 +02:00
osquery skip flaky suite (#170593) 2024-07-09 16:21:54 +01:00
painless_lab [Mgmt] Remove usage of deprecated modules for mounting React, Part II (#182043) 2024-05-07 08:59:44 -07:00
remote_clusters [Kibana Management] Add a limit when strings are too long (#186312) 2024-06-27 14:46:54 +02:00
reporting migrate getCurrentUser calls in reporting to core security service (#186913) 2024-06-28 17:25:09 -05:00
rollup [Kibana Management] Add a limit when strings are too long (#186312) 2024-06-27 14:46:54 +02:00
rule_registry [ResponseOps][Alerts] Implement platform alerts grouping components (#184635) 2024-07-08 19:23:49 +02:00
runtime_fields [Mgmt] Remove usage of deprecated modules for mounting React, Part II (#182043) 2024-05-07 08:59:44 -07:00
saved_objects_tagging [i18n][system upgrade] Upgrade Intl Packages from v2 to v6 (#179506) 2024-06-02 16:50:33 +03:00
screenshotting [Kibana logging system] Add conditional evaluation based on level for logging APIs (#187225) 2024-07-08 23:53:02 +10:00
search_connectors [Search] Renaming the search frontend group (#184565) 2024-06-03 13:14:49 -07:00
search_homepage [Search] Homepage header links (#187419) 2024-07-09 17:24:27 +02:00
search_inference_endpoints [Inference Endpoints View] Deletion, search and filtering of inference endpoints (#186206) 2024-07-09 08:42:52 -06:00
search_notebooks [Search] Notebooks Telemetry (#188007) 2024-07-11 09:40:41 +02:00
search_playground [Search][Playground] Update UI (#187608) 2024-07-10 15:05:59 +02:00
searchprofiler [EuiProvider] Use KibanaRenderContextProvider in Console A11y Overlay (#184488) 2024-05-31 10:43:16 -07:00
security [Security in Core] Exposes apiKeys from core.security.authc (#186910) 2024-07-09 23:43:17 +10:00
security_solution [Security Solution] Replace PrebuiltRuleAsset schema construction with Zod transform (#188092) 2024-07-12 15:24:16 +02:00
security_solution_ess [Stateful sidenav] Put recently accessed in footer for all solutions (#184298) 2024-05-28 17:00:04 +01:00
security_solution_serverless [Cloud Security] Metering integration tests 2024-07-10 00:35:15 +03:00
serverless Add "Give feedback" button (#180942) 2024-04-22 04:44:28 -07:00
serverless_observability [Serverless] make parent nav item into breadcrumb link (#183189) 2024-05-16 08:14:18 -04:00
serverless_search [Serverless Search Plugin] Migrate browser-side authc.getCurrentUser usage to coreStart.security (#187189) 2024-07-03 09:10:12 -07:00
session_view polyfill window.matchMedia in jsdom (#181710) 2024-04-30 05:26:29 -07:00
snapshot_restore [Kibana Management] Add a limit when strings are too long (#186312) 2024-06-27 14:46:54 +02:00
spaces [Space] Solution Badge (#186277) 2024-06-27 14:29:22 +02:00
stack_alerts [ES|QL] Rename text-based-languages pugin to esql plugin (#187520) 2024-07-10 00:16:32 +10:00
stack_connectors [Obs AI Assistant] Support for Gemini connector (#188002) 2024-07-12 08:53:23 +03:00
task_manager [Kibana logging system] Add conditional evaluation based on level for logging APIs (#187225) 2024-07-08 23:53:02 +10:00
telemetry_collection_xpack [Spaces] Passing default solution from cloud onboarding process (#185926) 2024-06-18 11:10:52 +02:00
threat_intelligence [i18n][system upgrade] Upgrade Intl Packages from v2 to v6 (#179506) 2024-06-02 16:50:33 +03:00
timelines [Security Solution] Reduce BrowserField to field spec (#187263) 2024-07-05 02:25:07 +10:00
transform [ML] AIOps: Refactors function argument structure for Log Rate Analysis. (#187669) 2024-07-08 20:06:40 +02:00
translations [Security Solution] Document flyout investigation guide and response action updates (#187920) 2024-07-12 04:02:11 +10:00
triggers_actions_ui [Kibana logging system] Add conditional evaluation based on level for logging APIs (#187225) 2024-07-08 23:53:02 +10:00
upgrade_assistant [Upgrade Assistant] Fix small issue with unknown indicators (#187326) 2024-07-04 19:09:17 +02:00
watcher Bump @elastic/elasticsearch to 8.14.0 (reloaded) (#186848) 2024-06-26 08:29:15 -07:00