* wip to get caseIds with alertId
* make work the API with the latest aggs from SO :)
* review
* change logic to re-do aggregation if we think that we are missing data
* Integration tests
Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co>
- For groupby/agg configs, removes the .keyword postfix for the agg name and field name being displayed. The config itself will still use the field name including .keyword.
- For histogram charts, if available, query data using the .keyword field. This enables support for charts for terms when there's both a text and keyword variant.
- Fixes isKeywordDuplicate check for field names with multiple dots in them.
## Summary
Fixes test flake:
https://github.com/elastic/kibana/issues/97365
By changing exact to an above count. I think the view of the index this large is not being given back consistent and could be a possible tooling gotcha, but I don't think we have a bug around this area. Either way, the test is still a valid test to ensure we don't blow up with errors, I just don't also test for exactness anymore.
Since this fixes tests and has no other inherit risk but should bring stability, I marked it as being back ported into the 7.13 branch for the next BC build of 7.13.
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
Phase 1 of a multi-phase cautious approach for adding an experimental application cache for Kibana solutions called `metric_entities` and integrates it within Security Solutions.
Phase 1 is putting experimental support into the application without breaking existing features. Lots of TODO's, conversations and a possible RFC from phase 1 to phase 2 approach. Some features are missing, but for phase 1 the general idea and code is all there.
To enable this first phase after checking out the branch add this to your `kibana.dev.yml`
```yml
xpack.metricsEntities.enabled: true
xpack.securitySolution.enableExperimental: ['metricsEntitiesEnabled']
```
Then go into Stack Management -> Advanced Settings (Under Security Solutions) and set the enabled to true like so:
<img width="1229" alt="Screen Shot 2021-04-08 at 2 21 02 PM" src="https://user-images.githubusercontent.com/1151048/114091276-b3cbb700-9875-11eb-9083-5c1d91dd20ed.png">
Next go to the security_solutions page and you will see it being activated and you will have these transforms running if you look under stack management:
<img width="1710" alt="Screen Shot 2021-04-29 at 2 00 27 PM" src="https://user-images.githubusercontent.com/1151048/116611174-4a2e4e00-a8f3-11eb-9e15-55cb504dfb2a.png">
On the hosts page, network, page, etc... You can see them being activated when you have no query/filter and you click on request:
<img width="1405" alt="Screen Shot 2021-04-29 at 2 01 28 PM" src="https://user-images.githubusercontent.com/1151048/116611274-6a5e0d00-a8f3-11eb-9998-9f5b3d1c5c63.png">
You will see in the request the index patterns all starting with `estc_xyz*`
### Checklist
Delete any items that are not applicable to this PR.
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
We have lots of TODO's but no concrete docs with this just yet.
- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
Behind a feature flag and this isn't there yet.
- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
* convert functional_tests/lib into TS
* convert ES cluster factory into TS
* fix exports from kbn-test
* fix core test_helpers
* remove legacy ES client usage in ui_settings tests
* remove unnecessary ts-expect-errors comments
* initialize DEFAULT_SETTINGS_WITH_CORE_PLUGINS lazily to prevent failure when imported outside of FTR context
* throw an exception on invalid process.env.TEST_ES_PORT
* [TSVB] Timeseries Drop last bucket should default to false
* Rename isLastBucketDropped prop and move series domain calculation to a separate file
* Fix failing tests because of wrong default value
* update drop_last_bucket.js
* Refactor drop_last_bucket and some functional tests
* Change infra metrics test values because of last bucket value changed
* Refactor series_domain_calculation and related code
* Update series_domain_calculations.test
* Update series_domain_calculations.test
* Fix tooltip showing wrong time
* Refactor index
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Alexey Antonov <alexwizp@gmail.com>
* [Maps] use index_exists route instead of /api/index_management/indices
* fix functional test
* add retry and correct permissions to fix functional tests
* fix upload functional test
resolves: https://github.com/elastic/kibana/issues/80120
Adds a new Kibana configuration key xpack.actions.customHostSettings which
allows per-host configuration of connection settings for https and smtp for
alerting actions. Initially this is just for TLS settings, expandable to other
settings in the future.
The purpose of these is to allow customers to provide server certificates for
servers accessed by actions, whose certificate authority is not available
publicly. Alternatively, a per-server rejectUnauthorized: false configuration
may be used to bypass the verification step for specific servers, but require it
for other servers that do not have per-host customization.
Support was also added to allow per-host customization of ignoreTLS and
requireTLS flags for use with the email action.
The transform wizard can become very slow when used with indices with e.g. 1000+ fields.
This PR fixes it by prefetching 500 random documents to create a list of populated/used fields and passes those on to the data grid component instead of all available fields from the list derived via Kibana index patterns.
For example, for an out of the box metricbeat index, this reduces the list of passed on fields from 3000+ to ~120 fields. Previously, the page would freeze on load for tens of seconds and would freeze again on every rerender. With the applied update, the page loads almost instantly again and remains responsive.
Note this fix of reducing available fields is only applied to the data grid preview component. All fields are still available to create the configuration in the UI for groups and aggregations. These UI components, e.g. the virtualized dropdowns, can handle large lists of fields.
* [Connectors][API] Updated connectors with enabledAfterImport flag
* fixed functional tests
* added new field to connectors API docs
* added update unit test
* fixed test
* renamed enableAfterImport to isMissingSecrets
* removed onExport
* revert the logic of true/false for isMissingSecrets
* fixed test
* fixed tests
* added unit test
* fixed docs
* fixed import text and button labels
* fixed import text
* fixed text
Adds a link to discover from the transform list to the actions menu. Conditions for the link to be enabled:
- Kibana index pattern must be available
- Transform must have been started once and done some progress so there's the destination index available
* test anomaly detection flyout anomalies
* add date test
* date test no anomalies for k8s
* test the threshold for anomalies
* add metrics data so can test 'show in inventory' link
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Reducing wrapping divs from RenderingService
* Applying more styles to .kbnAppWrapper
Some being temporary and will need a better solution when introducing the page layout component
* Almost fixing tests for rendering service
Can’t figure out how to have a optional Observable
`Received: "kbnAppWrapper class-name”`
* Adding some comments
* [Dashboard] Using the APP_WRAPPER_CLASS
* fix test & ts types
* Fixin a few more tests that were using `.app-wrapper`
* Creating docs for new var and cleaning up some selectors
* Fixing reporting
* Fixing banner position and truncation
* Fixed CSS error in loading screen and jump in animation
* Fixing selectors in Canvas
* Remove unused var
* Added `APP_WRAPPER_CLASS` export from `server` and updated reporting to use it
* Fix monitoring icon clicks
* move APP_WRAPPER_CLASS definition to src/core/common
* Fixing Monitoring snapshots and wrapper class
* Moved `APP_WRAPPER_CLASS` utils but exported from `public` and `server`
* Remove old folder
* Fix dashboard test by only showing HR in edit mode
Co-authored-by: pgayvallet
Co-authored-by: tsullivan
* Fixed Failing test for alerts list disable/mute operations.
* fixed tests
* removed awating check for switch status changed
* replaced api methos with ui call
* fixed merge
* reopen and close actions item menu
* fixed mute
* Update collapsed_item_actions.tsx
Remove changes
* removed retry
* add retry
* replaced try with try for time
* inceased retry
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
resolves: https://github.com/elastic/kibana/issues/97852
Adds `encodeURIComponent()` wrappers around references to rule, alert, and
connector ids. Without this fix, if an alert id (which can contain
customer-generated data) contains a character that needs to be URL
encoded, the resulting API call from the web UI will fail.
* wip: add api test for evaluate endpoint
* Add api test for evaluate endpoint
* add tests for view only and unauthorized user
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* WIP
* WIP
* Remove unnecessary fields
* Work on node detail page
* Cluster overview looking good
* Index page
* Fix types
* ML jobs
* CCR
* CCR
* We just need total here
* Standalone cluster fix
* Re-enable logstash
* FIx jest test
* Fix tests
* Fix tests
* Fix unused import
* Add new MB-based archives
* Add actual archives
* Fix types
* Add this file back in
* Fix tests and add more
* Update whitelist
* Renames
* Renames
* Only do ccs if enabled
* Updates
* Comment out
* More tests passing
* Another passing test
* More passing, yay
* Forgot to add the actual tests, wow
* CCR
* Fix CI issues
* Missed a field here
* Kibana tests passing
* Fix type issues
* Fix type
* Fix types
* Good chunk of logstash work
* Fix types
* Fix jest test
* Fix issue with get usage in logstash code
* Fix small bug here
* Update archives with proper mappings
* Handle both legacy and mb fields properly
* Fixes
* Fix jest test
* Fix issue
* Getting setup tests in a better state
* Only beats is failing now, which is good
* Progress on cluster listing
* Functional tests passing!
* More progress on cluster tests
* More cluster work
* Fix test
* Last recovery working
* Fix types
* Fix tests
* More tweaks
* Fix snapshot
* Use stats instead of kibana_stats
* Use node and node_stats for logstash
* Beats tests passing
* APM tests passing
* API tests passing!
* Fix types
* Fix tests
* Renames beats-with-restarted-instance archive dirs
Kebab case is disallowed for all newly added files.
* Renames logstash-pipeline dirs
Kebab case disallowed for all new files
* Renames multi-basic dirs
Kebab case disallowed for all new files
* Renames singlecluster-* dirs
Kebab case disallowed for all new files
* Fixes inaccurate path change for archive setup
* Reverts changes to rebuild_all script
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Revert "skip flaky suite (#97382)"
This reverts commit e321f57f64.
* Revert "skip flaky suite (#97387)"
This reverts commit a89b756710.
* Revert "Skip test to try and stabilize master" (#97378)
This reverts commit 194355fdd3.
* upload heap dumps when they are created
Co-authored-by: spalger <spalger@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
## Summary
closes#92591
Create a new `HostedAgentPolicyRestrictionRelatedError` which ensures the additional text from #92591 is included in all the appropriate places, but only specified once.
#### Some current examples
* `Cannot update integrations of hosted agent policy ${id}`
* `Cannot remove integrations of hosted agent policy ${id}`
* `Cannot reassign an agent to hosted agent policy ${newAgentPolicy.id}`
#### In this PR are now
* `Cannot update integrations of hosted agent policy ${id} in Fleet because the agent policy is managed by an external orchestration solution, such as Elastic Cloud, Kubernetes, etc. Please make changes using your orchestration solution.`
* `Cannot remove integrations of hosted agent policy ${id} in Fleet because the agent policy is managed by an external orchestration solution, such as Elastic Cloud, Kubernetes, etc. Please make changes using your orchestration solution.`
* `Cannot reassign an agent to hosted agent policy ${newAgentPolicy.id} in Fleet because the agent policy is managed by an external orchestration solution, such as Elastic Cloud, Kubernetes, etc. Please make changes using your orchestration solution.`
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Remove the defaultStrategy override
Move async search strategy to data
Move EQL search strategy to data
Move rest of common/search/session data (Moving whole search/session is blocked by security and taskManager)
* Use CodeEditor from react-utils which supports dark theme instead of deprecated EuiCodeEditor
* fix CI
* Fix CI
* Fix tests
* Update monaco_editor.ts
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Initial commit
* Add tests and support for concurrency
* Ability to disable functionality, use bulk APIs
* Fix type check
* Fix jest tests
* Cleanup
* Cleanup pt2
* Add unit tests
* Fix type check
* Fixes
* Update test failures
* Split schedule between cleanup and idle
* Add functional tests
* Add one more test
* Cleanup repeated code
* Remove duplicate actions plugin requirement
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* merge multiple timestamp queries into one single search
* fix types and unit tests
* remove unused code for sending secondary search
* removes unused excludeDocsWithTimestampOverride
* adds integration tests to cover cases that should / should not generate signals when timestamp override is present in rule
* adds integration test to ensure unmapped sort fields do not break search after functionality of detection rules
* Need to figure out why moving the tests around fixed them...
* updates tests with new es archive data and fixes bug where exclusion filter was hardcoded to event.ingested :yikes:
* remove dead commented out code
* fixes typo in test file, removes redundant delete signals call in integration test, fixes logic for possibility of receving a null value in sort ids, removes unused utility function for checking valid sort ids
* a unit test for checking if an empty string of a sort id is present was failing because we moved the logic for checking that out of the build search query function and up into the big loop. So I moved that unit test into the search after bulk create test file.
* fix types
* removes isEmpty since it doesn't check for empty strings
* Don't block standalone agent instructions when not using Fleet server yet
* Add service token instructions - UI only
* Add route for regenerating fleet server service token
* generate tokens instead of regenerate and add error catching and tests
* fix i18n typo
* i18n fix, add sudo, copy edits
* Fix commands
* Add missing test file
Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Now the new EuiDataGrid based document table is the default
* Columns can be sorted by drag and drop
* Column width can be changed by drag and drop
* There's a fullscreen mode
* There's document selection
* There's document navigation in the flyover of a expanded document
* Sorting is much more user friendly, less confusing and sort order can be changed by drag and drop
* [ML] add advanced settings
* [ML] default advanced settings
* [ML] advanced settings validators
* [ML] range control for top n buckets
* [ML] execute rule with a new query for most recent anomalies
* [ML] find most anomalous bucket from the top N
* Revert "[ML] range control for top n buckets"
This reverts commit e039f250
* [ML] validate check interval against the lookback interval
* [ML] update descriptions
* [ML] fix test subjects
* [ML] update warning message
* [ML] add functional tests
* [ML] adjust unit tests, mark getLookbackInterval
* [ML] update lookback interval description and warning message
* [ML] update fetchResult tsDoc
* [ML] cleanup
* [ML] fix imports to reduce bundle size
* [ML] round up lookback interval
* [ML] update functional test assertion
* [ML] async import for validator
* Added a11y tests for Remote Clusters plugin and fixed discovered violations
* Added an a11y test for a delete modal
* Updated payload type casting
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Remove alerting feature flag from advanced settings
Make it so the alerting UI in Observability can only be turned on and off in kibana.yml with `xpack.observability.enableAlertingExperience`.
We no longer:
* Allow turning this on and off for the current space in the advanced settings in Kibana
* Allow turning this on on cloud
* Send telemetry on whether or not the flag is enabled
Add some docs in READMEs as well.
* Add API integration tests for threshold rules and more tests for EQL rules
* Add API more tests for exceptions and value list exceptions
* Fix unit test and add EQL api test checking multiple signal generation
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Intercept installation errors and add meta info.
* Adjust mock.
* Catch errors in all steps of install/upgrade.
* Adjust handler for direct package upload.
* Don't throw not-found errors on assets during rollback.
* Correctly catch errors from _installPackage()
* Propagate error from installResult in bulk install case.
* Add tests for rollback.
* Remove unused code.
* Skipping test that doesn't test what it says.
* Fix and reenable test.
* Move inspector adapter integration into search source
* docs and ts
* Move other bucket to search source
* test ts + delete unused tabilfy function
* hierarchical param in aggconfig.
ts improvements
more inspector tests
* fix jest
* separate inspect
more tests
* jest
* inspector
* Error handling and more tests
* put the fun in functional tests
* code review
* Add functional test for other bucket in search example app
* test
* test
* ts
* test
* test
* ts
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Makes lens default editor in dashboard
Added all editors menu to dashboard panel toolbar
Fixed toggle on editor menu
Removed unnecessary comments
Added data test subjects to editor menu buttons
Populated editor menu with vis types
Removed unused imports
Fixed imports
Adds showCreateNewMenu prop to AddPanelFlyout
Rearranged order of editor menu options
Fixed ts errors
Added groupnig to embeddable factory
Use embeddable state transfer service to redirect to editors
Added showGroups to TypeSelectionState
Fixed add panel flyout test
Fixed data test subjects
Fixed factory groupings
Removed unused import
Fixed page object
Added telemtry to dashboard toolbar
Added telemtry to editor menu
Fix ml embeddable functional tests
Fix lens dashboard test
Fix empty dashboard test
Fixed ts errors
Fixed time to visualize security test
Fixed empty dashboard test
Fixed clickAddNewEmbeddableLink in dashboardAddPanel service
Fixed agg based vis functional tests
Revert test changes
Fixed typo
Fix tests
Fix more tests
Fix ts errors
Fixed more tests
Fixed toolbar sizes and margins to align with lens
Fix tests
Fixed callbacks
Fixed button prop type
New vis modal copy updates
Added savedObjectMetaData to log stream embeddable factory
Addressed feedback
Fixed ts error
Fix more tests
Fixed ts errors
Updated dashboard empty prompt copy
Adds tooltip to log stream embeddable factory saved object meta data
Made icons monochrome in toolbar
Fixed icon colors in dark mode
Cleaned up css
Fixed ts errors
Updated snapshot
Fixed map icon color
* Added tooltips for ML embeddables
* Restored test
* Added empty dashboard panel test
* Fixed i18n id
* Fix dashboard_embedding test
* Removed unused service
* Fixed i18n error
* Added icon and description properties to embeddable factory definition
* Fixed ts errors
* Fixed expected value
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Adds helper to normalize legacy ML rule field to an array
This will be used on read of rules, to normalize legacy rules while
avoiding an explicit migration.
* Fix our detection-specific ML search function
Luckily this was just a translation layer to our anomaly call, and the
underlying functions already accepted an array of strings.
* WIP: Run rules against multiple ML Job IDs
We don't yet support creation of rules with multiple job ids, either on
the API or the UI, but when we do they will work.
Note: the logic was previously to generate an error if the underlying
job was not running, but to still query and generate alerts. Extending
that logic to multiple jobs: if any are not running, we generate an
error but continue querying and generating alerts.
* WIP: updating ml rule schemas to support multiple job IDs
* Simplify normalization method
We don't care about null or empty string values here; those were
holdovers from copying the logic of normalizeThreshold and don't apply
to this situation.
* Move normalized types to separate file to fix circular dependency
Our use of NonEmptyArray within common/schemas seemed to be causing the
above; this fixes it for now.
* Normalize ML job_ids param at the API layer
Previous changes to the base types already covered the majority of
routes; this updates the miscellaneous helpers that don't leverage those
shared utilities.
At the DB level, the forthcoming migration will ensure that we always
have "normalized" job IDs as an array.
* Count stopped ML Jobs as partial failure during ML Rule execution
Since we continue to query anomalies and potentially generate alerts, a
"failure" status is no longer the most accurate for this situation.
* Update 7.13 alerts migration to allow multi-job ML Rules
This ensures that we can assume string[] for this field during rule
execution.
* Display N job statuses on rule details
* WIP: converts MLJobSelect to a multiselect
Unfortunately, the SuperSelect does not allow multiselect so we need to
convert this to a combobox. Luckily we can reuse most of the code here
and remain relatively clean.
Since all combobox options must be the same (fixed) height, we're
somewhat more limited than before for displaying the rows. The
truncation appears fine, but I need to figure out a way to display the
full description as well.
* Update client-side logic to handle an array of ML job_ids
* Marginally more legible error message
* Conditionally call our normalize helper only if we have a value
This fixes a type error where TS could not infer that the return value
would not be undefined despite knowing that the argument was never
undefined. I tried some fancy conditional generic types, but that didn't
work.
This is more analogous to normalizeThresholdObject now, anyway.
* Fix remaining type error
* Clean up our ML executor tests with existing contract mocks
* Update ML Executor tests with new logic
We now record a partial failure instead of an error.
* Add and update tests for new ML normalization logic
* Add and update integration tests for ML Rules
Ensures that dealing with legacy job formats continues to work in the
API.
* Fix a type error
These params can no longer be strings.
* Update ML cypress test to create a rule with 2 ML jobs
If we can create a rule with 2 jobs, we should also be able to create a
rule with 1 job.
* Remove unused constant
* Persist a partial failure message written by a rule executor
We added the result.warning field as a way to indicate that a partial
failure was written to the rule, but neglected to account for that in the
main rule execution code, which caused a success status to immediately
overwrite the partial failure if the rule execution did not otherwise
fail/short-circuit.
* Set up Observability rule APIs
* Populate alerts table with data from API
* Move field map types/utils to common
* Format reason/link in alert type
* Format reason/link in alert type
* Fix issues with tsconfigs
* Storybook cleanup for example alerts
* Use `MemoryRouter` in the stories and `useHistory` in the component to get the history
* Replace examples with ones from "real" data
* Use `() => {}` instead of `jest.fn()` in mock registry data
* Store/display evaluations, add active/recovered badge
* Some more story fixes
* Decode rule data with type from owning registry
* Use transaction type/environment in link to app
* Fix type issues
* Fix API tests
* Undo changes in task_runner.ts
* Remove Mutable<> wrappers for field map
* Remove logger.debug calls in alerting es client
* Add API test for recovery of alerts
* Revert changes to src/core/server/http/router
* Use type imports where possible
* Update limits
* Set limit to 100kb
Co-authored-by: Nathan L Smith <smith@nlsmith.com>
## Summary
Fixes a bug where on the DNS tab of networks you can get a `too_many_buckets_exception`. Worked through the query with @angorayc and together I think we figured out that the query could be re-written with aggregations in a way to get the same results without having to query a large amount of terms which causes the buckets exception.
Added a e2e test and one way of being able to call bsearch in the e2e when it returns the search is still in progress so we don't have the large query test cause flakiness 🤞 .
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
- fcbc9d9 Rename `force` param to `revoke` for `/agents/{agent_id}/unenroll` & `/agents/bulk_unenroll`
- 03b9b90 Add new `force` param
See https://github.com/elastic/kibana/issues/96873 for background
<table>
<thead>
<tr>
<td rowspan="2"></td><td colspan="2">Unenroll Agent</td><td rowspan="2">Revoke API Keys</td>
</tr>
<tr>
<td>Regular</td><td>Hosted</td></td>
</tr>
</thead>
<tr><td colspan="4"><strong>Rename <code>force</code> to <code>revoke</code></strong></td></tr>
<tr><td>Current <code>force=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Proposed <code>revoke=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Current <code>force=true</code></td><td>✅</td><td>❌</td><td>✅</td></tr>
<tr><td>Proposed <code>revoke=true</code></td><td>✅</td><td>❌</td><td>✅</td></tr>
<tr><td colspan="4"><strong>Change <code>force</code> param </strong></td></tr>
<tr><td>Proposed <code>force=false|undefined</code></td><td>✅</td><td>❌</td><td>❌</td></tr>
<tr><td>Proposed <code>force=true</code></td><td>✅</td><td>✅</td><td>❌</td></tr>
<tr><td>Proposed <code>force=true</code> & <code>revoke=true</code></td><td>✅</td><td>✅</td><td>✅</td></tr>
</table>
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
### Changes required for consumers
Any call to `/agents/{agent_id}/unenroll` & `/agents/bulk_unenroll` which passes the `force` param should change to `revoke` to maintain the current behavior.
* Reporting: Fix _index and _id columns in CSV export
* optimize - cache _columns and run getColumns once per execution
* Update x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
Co-authored-by: Michael Dokolin <dokmic@gmail.com>
* feedback
* fix typescripts
* fix plugin list test
* fix plugin list
* take away the export interface to test CI build stats
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Michael Dokolin <dokmic@gmail.com>
* network module
adds the network module with four ml jobs for the 7.13 release
* Update datafeed_high_count_network_denies.json
json formatting
* update test
added the security_network module to the list
* renames
module name change to security_network / Security: Network
* formatting
change hyphen char to underscores
* fixes and name changes
fixes to df queries, descriptions. created_by param
* update tests
tests need the security_network module added
* formatting
change hyphens to underscores
* descriptions
format descriptions
* Update datafeed_high_count_network_events.json
indentation fixes
* Update x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/manifest.json
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
* Update x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
* Update datafeed_high_count_network_events.json
change to a filter
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
* - migrated use of legacy.client to client
- removed use of isEsError to detect legacy errors
- refactored types to use types from @elastic/elasticsearch
instead (where appropriate)
tested get, put, post, delete, simulate and documents endpoints
locally
* remove use of legacyEs service in functional test
* fixing type issues and API response object
* remove id from get all request!
* reinstated logic for handling 404 from get all pipelines request
* clarify error handling with comments and small variable name refactor
* updated delete error responses
* update functional test
* refactor use of legacyEs
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Can now pass a `force=true` parameter to add & remove integrations on hosted policies as originally intended [1] & [2]
* Add `force` param for `POST` `/api/fleet/package_policies` & `/api/fleet/package_policies/delete` to a policy. Update tests to confirm
* Not strictly required, but "while I was in there"
* Updated a few places to throw `IngestManagerError` vs `Error` for `400` response vs `500`. Updated tests.
* removed a few unnecessary `await`s of sync function
[1] https://github.com/elastic/kibana/issues/92426#issuecomment-785092670
[2] https://github.com/elastic/kibana/issues/90445
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* [TSVB] Visualize runtime fields
* fix CI
* Update visualization_error.tsx
* Update build_request_body.ts
* fix group by for table view
* fix issue on switching the index pattern mode
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* [Fleet] Install security_rule assets as saved objects
* Add security-rule to update_assets.ts
* Update UUIDs for security_rule asset
* Change .type to match the saved object type not the asset type
* Add saved object mapping for security-rule
* Make SO non-hidden
* Fix SO mapping for security-rule
* Make security-rule a non-hidden asset
resolves https://github.com/elastic/kibana/issues/92949
This PR adds two new Kibana config keys to further customize when the proxy
is used when making HTTP requests. Prior to this PR, if a proxy was set
via the `xpack.actions.proxyUrl` config key, all requests would be
proxied.
Now, there's a further refinement in that hostnames can be added
to the `xpack.actions.proxyBypassHosts` and `xpack.actions.proxyOnlyHosts`
config keys. Only one of these config keys can be used at a time.
If the target URL hostname of the HTTP request is listed in the
`proxyBypassHosts` list, the proxy won't be used.
If the target URL hostname of the HTTP request is **NOT** listed in the
`proxyOnlyHosts` list, the proxy won't be used.
Depending on the customer's environment, it may be easier to list the hosts to
bypass, or easier to list the hosts that should only be proxied, so they can
choose either method.
* initial pass at es client migration
* fixed potential for not passing in an error message and triggering an unhandled exception
* reworked ad hoc fixing of error response
* delete legacy client file and remove use of legacyEs service
* remove unused import
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
- Fix color assertion with risk of percentage being rounded to 0.
- Better naming of attributes of expected values.
- Adds assertions to use the sample size dropdown and randomize query switch.
* starting removing stuff
* fix jest config
* disable CLI mode until other PR is merged
* fix the schema
* add deprecation for maxPayloadBytes
* fix legacy start logic
* deletes `env` from unknown args
* fix FTR test config
* some legacy service deletion
* move config validation
* remove legacy exports from entrypoint
* preserve legacy logging in core logging config
* try to fix uiSettings integration tests
* fix legacy service tests
* more type fix
* use fromRoot from @kbn/utils
* cleanup kibana.d.ts
* fix unit tests
* remove src/core/server/utils
* fix server script
* add integration test for `/{path*}` route
* add unit tests on legacy config
* adapt uiSetting IT bis
* fix tests
* update generated doc
* address some review comments
* move review comments
* fix some stuff
* fix some stuff
* fix some stuff
* fix some stuff bis
* generated doc
* add test for ensureValidConfiguration
* fixes a skipped management x-pack test
* modified the test to incoroporate the review comments
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* add spaces test
* fix updating and deleting sessions in non-default space
* revert back to batch update
* Add space tests
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Liza K <liza.katz@elastic.co>
* [APM] Correlations support for progressively loading sections (#95059)
* fixes type consistency
* - Adds progressive section loading for errors tab in correlations
- code improvements
* Tests for latency correlations and overall distribution APIs
* adds API test for error correlations endpoints
* renamed 'getOverallErrorDistribution' to 'getOverallErrorTimeseries'
* Code improvements
* fix whitespace
* [Reporting] CSV Export: fix and unskip failing test
* fix snapshot extra records
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* wip, migrated routes and plugins
* refactored all ES error handling to use handleEsError and new isEsError detection
* - fixed Jest tests for new es client
- updated routes in light of new responses
* remove unused import
* remove unecessary isEsError check in rest api route handlers
* mute all incorrect types from client lib using @ts-expect-error
* reordered and clean up imports, removed legacy client code
* update legacy test runner
* updated use of legacyES
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* chore(NA): move elastic-datemath into a ts package
* chore(NA): finish elastic-datemath
* chore(NA): finish elastic-datemath
* chore(NA): source folder for elastic-datemath
* chore(NA): add source-maps ace, analytics, apm-config-loader and apm-utils packages
* chore(NA): add sourcemaps to packages on typescript
* chore(NA): move test fixtures within source
* chore(NA): correct exclusions on packages
* chore(NA): correct package.json on all packages
* chore(NA): correct package.json on all packages
* chore(NA): complete kbn pm
* chore(NA): default export on elastic-datemath
* chore(NA): include logs on kbn-logging
* chore(NA): update bundle ref module to last code used in the webpack upstream
* chore(NA): update bundle ref module to last code used in the webpack upstream - refactored
* chore(NA): remove override method for exportsArgument
* fix(NA): typechecking problems by use @internal at javascript import sources on kbn-test package
* fix(NA): typescript projects check
* fix(NA): run optimizer integration tests from source
* chore(NA): fix usage from target for kbn optimizer
* chore(NA): path on tsconfig
* chore(NA): move tsignore into ts-expect-error
* chore(NA): include souce maps on kbn cli dev
* chore(NA): include souce maps on kbn-crypto, kbn-server-http-tools and kbn-telemetry-tools
* chore(NA): add issue links into the ts-expect-error comments
* [file_upload] add has_import_permission route
* remove ml hasImportPermissions
* fix tsconfig path
* tslint
* review feedback
* make pipeline check optional since geojson upload does not use pipeline
* ts cleanup
* make geojson permission failure message actionable
* revert privilege change in functional test
* add global_index_pattern_management_all permission to functional test
* rename hasPipeline to checkHasManagePipeline
* add api integration test
* tslint
* revert change to es_search_source
* simpilify error message when users can't create index pattern
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Move current alert HTTP APIs to legacy folder (#93943)
* Move current HTTP APIs to legacy folder
* Rename BASE_ALERT_API_PATH to LEGACY_BASE_ALERT_API_PATH
* Fix failing tests and extra files
* Create new rule HTTP APIs (#93980)
* Move current HTTP APIs to legacy folder
* Rename BASE_ALERT_API_PATH to LEGACY_BASE_ALERT_API_PATH
* Fix failing tests and extra files
* Move current alert HTTP APIs to legacy folder (#93943)
* Move current HTTP APIs to legacy folder
* Rename BASE_ALERT_API_PATH to LEGACY_BASE_ALERT_API_PATH
* Fix failing tests and extra files
* Add necessary files
* Create rule route
* Get rule API
* Update rule API
* Delete rule route
* Aggregate rules API
* Disable rule API
* Enable rule API
* Find rules API
* Fix Update API
* Get rule alert summary API
* Get rule state API
* Health API
* Rule types API
* Mute all API
* Mute alert API
* Unmute all API
* Unmute alert route
* Update API key API
* corrected tpye by making it much more complicated
* removed unneeded cocde
* Fixes
* Add back health route
* mutedInstanceIds -> mutedAlertIds
* lastRun -> last_run
* alert_type_state -> rule_type_state & alert_instances -> alerts
Co-authored-by: Gidi Meir Morris <github@gidi.io>
* Create docs for new rule HTTP APIs, deprecate old docs (#94745)
* Create docs for new APIs, deprecate old docs
* Remove connector_type_id
* Update docs
* Add link to legacy APIs from rules API docs
* Remove connector_type_id references
* [DOCS] Add legacy APIs to index.asciidoc
* Fix camel case
Co-authored-by: lcawl <lcawley@elastic.co>
* Make alerting tests use new rules APIs (#95159)
* Make API integration tests use new HTTP APIs
* Fix end to end tests
* Fix test failures
* Fix more test failures
* Rename some files
* Add tests for legacy APIs (#95333)
* Initial commit (#95457)
* Move some new alerting APIs to /internal (#95461)
* Initial commit
* Update README.md
* Use internal API
* Merge deprecated warning w/ alternative solution
* Update API docs
Co-authored-by: Gidi Meir Morris <github@gidi.io>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: lcawl <lcawley@elastic.co>
* pass error reason for ES responses provided in HTTP response body
* add a test
* ML: update functional tests when index does not exist
* transform: fix integration test for error message
* Make 'enter time range' value as default and add telemetry for 'last value' mode
* Fix telemetry schema
* Fix test
* Add possibility count timeseries created from dashboard
* Fix remark
* Fix remark
* Fix problem with time_range_mode
* Fix tests
* Fix tests
* Fix tests for markdown and table
* exclude TSVB which have type as timeseries
* Add description for field in schema in telemetry
* Fix telemetry schema
* Fix some remarks
* Added check for hits
* fix CI
* fix CI
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Alexey Antonov <alexwizp@gmail.com>
**Related to:** https://github.com/elastic/kibana/pull/94143
## Summary
This PR adds new fields to the schema (`EventSchema`, `IEvent`):
- standard ECS fields: `error.*`, `event.*`, `log.level`, `log.logger`, `rule.*`
- custom field set `kibana.detection_engine`
We need these fields on the Detections side to implement detection rule execution log. See the related proposal (https://github.com/elastic/kibana/pull/94143) for more details.
Also, this PR bumps ECS used in Event Log from `1.6.0` to the current `1.8.0` version. They are 100% same in terms of fields used in Event Log, so no changes in the schema were caused by this version increment.