This PR adds a new syntax to KQL for querying nested fields.
Nested fields can be queried in two different ways:
Parts of the query may only match a single nested doc (bool inside nested). This is what most people want when querying on a nested field.
Parts of the query may match different nested docs (nested inside bool). This is how a regular object field works but nested fields can be queried in the same way. Although generally less useful, there are occasions where one might want to query a nested field in this way.
The new KQL syntax supports both.
* [APM] Use indexPatternsService for kuery bar suggestions
Closes#44487.
* Use simpler message format
* Remove missing labels
* Get index names from setup.indices
* Add back removed logic copying feature properties for injected data prior to modification
* Back out injected data and assign featureCollection to sourceDescriptor with __ prefix
* Review feedback. Ensure __featureCollection is always initialized minimally to a geojson object with an empty features array
* Check for null/undefined
* Add loading indicator to Lens workspace panel
* [Expressions] [Lens] Handle loading and errors in ExpressionRenderer
* Using loading$ observable and improve tests
* [Lens] Fix layer crash and improve layer suggestions
* Using CSS and to handle layout of expression renderer
Added TODO for using chart loader when area is completely empty
* Improve error handling and simplify code
* Fix cleanup behavior
* Fix double render and prevent error cases in xy chart
* Fix context for use in dashboards
* Remove className from expression rendere component
* Improve handling of additional interpreter args
* More layout fixes
- Hide chart if Empty not Loading
- Fix relative positioning for progress bar since className is no longer passed (super hacky)
* Build suggestions that remove layers
* Update tests and add keptLayerIds everywhere
* Fix bug where datatable would accept multi-layer suggestions
* Build more suggestions that work with metric/datatable
* Fix issue with chart switching from empty
* Fix datatable multiple layer issue
* Move storage to kibana_utils
* Updated all references to Storage and replace places where it was referenced to as "store" to avoid confusion.
* fixed tests
* Delete data legacy dependencies plugin
* Imports fix
* update snapshots
* Renaming Infrastructure to Metrics whenever the context is the metrics app.
* More renames, and picking up a few stray references to Infrastructure/Metrics/Logs UI too.
* Fixing typo
* Add UI Indices runtime configuration
- index configuration in settings page
- defaults to kibana.yml configuration values
* fix tests
* Code review feedback and cleanup
* fix i18n
* Code review feedback
* Address code review feedback.
* Fixes bug where legacy data filter was including the
.apm-agent-configuration index which caused failures in those APIs
## Summary
* Removes the older beginner KQL type of signal creation in favor of newer version with filtering
* Adds ability to create KQL or lucene queries that will work with the UI filters
* UI state with the filters are now savable to re-hydrate UI's on the front end
* Adds `saved_id` ability so the UI can tether dynamic saved queries with signals
* Changed `it` to `test` as `it` is not the alias we use for tests
* Updated script which converts older saved searches to work with newer mechanism
* Fixed script to accept proper ndjson lines
* Adds validation unit tests for the endpoint
* Increases validation strictness of the endpoints
* Adds more data scripts for testing scenarios
* https://github.com/elastic/kibana/issues/47013
## Testing
* Run `./hard_reset.sh` script
* Test with both algorithms through this toggle before starting kibana:
`export USE_REINDEX_API=true`
* Convert older saved searches to compatible new query filters by running:
`./convert_saved_search_to_signals.sh ~/projects/saved_searches /tmp/signals`
* Post them`./post_signal.sh /tmp/signals/*.json`
* Hard reset again
* Test smaller set of signals and REST endpoints using the typical scripts of:
```sh
./post_signal.sh
./read_signal.sh
./find_signals.sh
./update_signal.sh
./delete_signal.sh
```
or test using POSTMAN, etc... If you want to test validation. If you see any validation issues let me know as I have validation testing files and can easily fix them add another unit test to the growing large collection we have now.
Change in your advanced settings of SIEM to use your signals index you configured for verification that the signals show up.
### Checklist
Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.
~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~
~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~
~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~
- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~
### For maintainers
~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
* Update moment related packages
* unify moment version in yarn.lock
* adapt ro pluralization fixes
* update some bad pluralization in fixtures/snapshots
