Commit graph

27575 commits

Author SHA1 Message Date
Melissa Alvarez 9e3a3dc7c6
[ML] Reorganize ML navigation with top and sub level tabs (#45220)
* Add main nav tabs with sub tabs for new nav

* move transforms to top level main nav

* Make top nav normal font weight

* Update breadcrumbs to take top nav into account

* proper spacing when settings selected

* fix localization error

* Fix functional tests. Update breadcrumbs

* revert analytics breadcrumb update. save for follow up

* ensure main/sub tabs align left

* update dataVisualizer breadcrumbs

* update typescript for tabs
2019-09-12 09:09:36 -04:00
Liza Katz a45b0a7bbf
Split data and expression plugins (#45125)
* split data plugin from expression plugin

* added expressions as dependency to visualizations

* ui/agg import

* expressions start contract
replace __SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED with __LEGACY

* Rename contract

* vis deps

* Fix build pipeline mocks

* Added expressions plugin to karma mock

* update imports

* export types from common

* Restore types.ts

* Remove unused expressions plugin server code
2019-09-12 15:57:58 +03:00
Larry Gregory 3e960e3e5c
Spaces - fix SecureSpaceMessage visibility (#44829)
* fix SecureSpaceMessage visibility

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2019-09-12 08:49:12 -04:00
Jean-Louis Leysens 5c2d0cae9c
Console to NP ready (#43346)
*  General structure of Public w/ legacy brace + autocomplete 🤔
 Refactor Resizer functionality (panel component)
 Refactor Play Button
 Refactor Auto-completion
 Refactor Docs opener
 Refactor Storage

* First refactor of kbn ace keyboard mode to TS+React

* clean up unused props

* console_menu.js -> console_menu.tsx

* Remove unused file from quarantine and added fixed ui ace keyboard mode react hook

* - Refactored history and storage to app-wide services
- Pre-emptive changes to tests
- sense-history -> HistoryList
- removed unused kbn top nav v2 component

* A lot of cleanup, re-introduced editor resize checker, re-introduced history viewer as TS+React. `history` still needs refactoring.

* First iteration of tap nav menu, with history toggle working

* Lots of fixes
Also moved over and integrated remaining three react components

* Moved a lot of files around again, tidied up NP set up

* Replace angular directive

* Remove used code

* Re-order imports and move all ace dependencies to same location

* Remove more unused code

* Revise quarantined setup mocks

* Don't suggest 'undefined' or other null-like values in autocomplete

* Clean up api_server folder

* Re-add missing style

* Updated karma spec mock

* Fix editors cutting of at bottom of screen

* Refactor console editors into single components
Refactor a lot of business logic to main.tsx container
Minor renaming of variables for better readability

* Updated use of contexts with better error message
Fixed broken render sync cycles (using useCallback)
Fixed Main container render cycle (added missing deps to useEffect)
Fixed default input and removed auto indent from being called on init for already formatted text

* Updated test mocks

* Update to be more in line with NP conventions https://github.com/elastic/kibana/blob/master/src/core/CONVENTIONS.md

* Update console history when making new requests
Fixed spacing between editor and console history
Moved registration of keyboard commands to TS
Fixed setup_mocks.js after renaming app to application

* Clean up git merge conflict artifact

* Use updated NP interfaces

* More typings fixed after updating local project dependencies

* Removing some dependencies on KUI and font awesome from legacy editor

* Fix clear history not re-rendering
Refactor prop name to be more descriptive

* Simplify split_panel and add tests

* Fix accessibility tabbing behaviour for ace editor

* Refactor ConsoleEditor into two separate components
Remove unused changeCursor code
Remove unused textArea ref
Use default lodash debounce (remove unnecessary arg)

* Major a11y fix when tabbing
Major fix for ace in IE11 and Edge browsers

* Update comment
2019-09-12 13:28:29 +02:00
Søren Louv-Jansen 19837fea23
[APM] Add "Quick links" to test plan 2019-09-12 13:23:32 +02:00
Søren Louv-Jansen 8a6b1518ef
Renamed tested-after-ff to apm-test-plan-done 2019-09-12 13:13:14 +02:00
Gidi Meir Morris 1c6b9336e3
[alerting] Renames the AlertInstance.fire to scheduleActions (#45245)
Renamed the misleadingly named AlertInstance.fire to scheduleActions, as it does not in fact "fire" the actions, but rather schedules them to be executed by the Task Manager at the next available opportunity.
2019-09-12 09:34:24 +01:00
Dmitry Lemeshko a33909a480
Change data-test-subj selector logic to support value with spaces (#43682)
* update test-subj-selector

* update locators

* adjust whitespaces removal

* fix another locator

* fix ML test locators
2019-09-12 09:48:09 +02:00
Andrew Goldstein 40147fa83f
[SIEM] Apply highlighting to the Timeline data providers drop area and flyout button (#45173)
## Summary

To indicate they accept droppable data providers, this PR applies highlighting to the Timeline flyout badge and data providers drop area.

Tested in dark and light mode in:
- Chrome `76.0.3809.132`
- Firefox `69.0`
- Safari `12.1.2`

## Timeline data providers (drop area) highlighting behavior

- While a data provider is being dragged, in a page or from within the timeline itself, apply `euiColorSuccess` to the timeline data providers drop area's dashed borders and "plain" text, but NOT to the other primitives, i.e. data provider badges, `AND` / `OR` circular badges, lines, etc  
- While a data provider is being dragged, in a page or from within the timeline itself, but NOT hovering over the data providers drop area, apply the `euiColorSuccess` color with `10%` alpha channel to the background of the data providers drop area
- While a data provider is being dragged over the drop target area inside the data providers drop zone, apply the `euiColorSuccess` color with `20%` alpha channel to the background of the data providers drop area
- While a data provider is being dragged over the drop target area inside the data providers drop zone that will add the data provider as an `AND` clause, apply `euiColorSuccess` color to the dashed border, and fill the background with the `euiColorSuccess` color with `30%` alpha channel to the background of the data providers drop area
- Do NOT apply highlighting styles when a column or field (non-data provider) is dragged from the timeline or the `Events` widget

### Dark mode

![timeline-highlighting-dark](https://user-images.githubusercontent.com/4459398/64755303-ebcb1680-d4e7-11e9-8452-0f91ddae85d1.gif)

### Light mode

![timeline-highlighting-light](https://user-images.githubusercontent.com/4459398/64755318-fc7b8c80-d4e7-11e9-8621-a7eb918468aa.gif)

## Flyout button highlighting behavior

- The (default) timeline flyout button is styled as non-filled EUI button
- The button text reads `Timeline ^` (with a trailing caret), instead of `T I M E L I N E`
- Hovering over the flyout button while NOT dragging underlines the flyout button text, but does not fill the background
- When a user starts dragging a data provider, apply `euiColorSuccess` to all visible flyout button properties (e.g. border, text)
- While a data provider is being dragged, in a page or from within the timeline itself, but NOT hovering over the flyout, apply the `euiColorSuccess` color with `10%` alpha channel to the background of the flyout button
- While a data provider is being dragged, in a page or from within the timeline itself, AND hovering over the flyout such that it's in a droppable state, apply the `euiColorSuccess` color with `20%` alpha channel to the background of the flyout button
- While a data provider is being dragged, in a page or from within the timeline itself, AND hovering over the flyout such that it's in a droppable state, replace the `Timeline ^` with a circle containing a `+` plus sign
- Apply `EuiNotificationBadge` styling to the data providers badge count, and position it in the upper left-hand corner
- Do NOT apply highlighting styles when a column or field (non-data provider) is dragged from the timeline or the `Events` widget

### Dark mode

![timeline-badge-dark](https://user-images.githubusercontent.com/4459398/64755512-5ed48d00-d4e8-11e9-9be2-02da70ac4e16.gif)

### Light mode

![timeline-badge-light](https://user-images.githubusercontent.com/4459398/64755531-7449b700-d4e8-11e9-9239-62ee78a6e652.gif)

Resolves https://github.com/elastic/siem-team/issues/457
2019-09-12 01:04:20 -06:00
Spencer 9a109f2170
Revert "Revert "Revert "Revert "[ci] compress jobs for CI stab… (#45454)
* Revert "Revert "Revert "Revert "[ci] compress jobs for CI stability" (#44584)"""

This reverts commit 148b8c0f90.

* sync changes with Jenkinsfile
2019-09-11 15:27:43 -07:00
gchaps c5e7a98740
[DOCS] Updates Saved objects docs (#45310)
* [DOCS] Updates Saved objects docs

* [DOCS] Incorporates review comments

* [DOCS] Changed intro per review comments

* [DOCS] More updates to Saved objects doc
2019-09-11 14:45:43 -07:00
spalger c0dd0ca7d3 skip flaky test (#45450) 2019-09-11 14:21:33 -07:00
spalger 45711a3005 skip flaky test (#45447) 2019-09-11 14:20:54 -07:00
Tre 93e6041ac8
[Plugin Generator] Enhance Integration Test (#45401)
* Add the missing blank line.
Add a test verify it.

* Less code is the best code.  Thanks Spencer :)
2019-09-11 15:10:47 -06:00
Lisa Cawley 80c05bf928
[DOCS] Adds user folder (#45411) 2019-09-11 12:59:38 -07:00
Jonathan Budzenski f8abcc4ea3
[test/x-pack] add matching functional_test_runner script (#44939)
* [test/x-pack] add matching functional_test_runner script

* make readme consistent
2019-09-11 14:52:43 -05:00
Jean-Louis Leysens 78cc334c2a
Update dependencies (#45133) 2019-09-11 21:39:13 +02:00
Dario Gieselaar bf7658b431
[APM] Fix IE layout issue for filters popover (#45370) 2019-09-11 21:35:15 +02:00
Dario Gieselaar 0b98cce683
[APM] Use EUITab classNames to render tab links (#45371) 2019-09-11 21:34:43 +02:00
Mikhail Shustov 7d9ffd256c
remove unused properties and duplicated operations (#45347) 2019-09-11 21:28:00 +02:00
Brian Seeders 27d23c4184 Jenkins pipeline with parallel cigroups (#45285)
* Pipeline

* WIP some work for parallelization with ciGroups

* Fix xpack kibana install dir, and add some debugging

* Attempt to quick fix a few tests

* Revert "Revert "Revert "[ci] compress jobs for CI stability" (#44584)""

This reverts commit 078ac2897f.

* Recombine test groups, and try runbld again

* Mostly cleanup, and fix failed_tests reporting to hopefully work for both pipeline and non-pipeline

* Fix typo in shell script

* Remove some debug code

* Add support for changing es transport.port during testing via TEST_ES_TRANSPORT_PORT

* Fix test that uses hard-coded es transport port and add it back in to parallel groups

* Disable checks reporter again for now

* Set env var for TEST_ES_TRANSPORT_PORT in pipeline

* Update Jenkinsfile for shorter testrunner labels

* Fix another hard-coded transport port

* Fix a new test with hard-coded URLs

* Jenkinsfile cleanup and fix one of the groups

* Fix double slash

* Testing vault credentials on jenkins server

* Add a non-existent credential

* Revert "Add a non-existent credential"

This reverts commit 0dc234c465a5483b1a994cb510a182fef766e9cc.

* Try github-checks-reporter again

* github-checks-reporter should only run for elastic/kibana, forks won't work

* Clean up some debug code

* Changing names around to try to make BlueOcean UI a little better

* Add more stages

* Make some changes to stage structure to mirror a nested example from CloudBees

* Handle TODOs, and some cleanup in Jenkinsfile

* Pass GIT_BRANCH when started without GHPRB, fix branch check

* Fix mailer problem and add code that ensures all tests are in cigroups back in

* Test adding worker/job name to junit report paths

* Remove some duplication from ci_setup scripts

* Fix unit test that uses junit path

* Don't reinstall node every time setup_env is run

* Fix yarn install logic

* Fix another unit test that uses junit output dir

* Download latest ES snapshot after kibana builds

* Make sure junit reports are always processed

* Add two failing tests for testing purposes

* Add support to Jenkinsfile for kibana build e-mails

* Remove some debug code for email sending

* Change JOB env handling in junit paths and move it to a sub-directory

* Revert "Add two failing tests for testing purposes"

This reverts commit 5715203e26922a93483feb0ebb8bb3fdcc3daf8c.

* Fix junit report path in test

* Don't send kibana emails on build abort

* Address PR feedback, formatting and use built-in url formatting library

* Fix path formatting for functional test

* Add email sending back in to Jenkinsfile

* Fix another unit test with path problem
2019-09-11 11:58:28 -07:00
renovate[bot] 767cf06c0d Update dependency @percy/agent (#45311) 2019-09-11 11:52:32 -07:00
Ryland Herrick 98b652b484
[Code] Search results are fixed to top of page (#45182)
* Fix main search bar to top of screen

By allowing overflow on the main content, we implicitly fix the sibling
search bar in position.

elastic/code#1606

* Allow search suggestion text to be truncated

This gives the parent element a width, so that our text-overflow
rules apply to these elements.

See https://bugzilla.mozilla.org/show_bug.cgi?id=1086218#c4 for details
on the issue.

* Fix alignment issue with overflowed search suggestions

If both the icon and the text are allowed to grow/shrink as needed,
flexbox will grow truncated text based on its original width, leading to
subtle sub-pixel alignment issues with other rows.

By fixing the icon to a specific width, we can ensure that the
suggestion text does not grow too big.

* Remove unneeded CSS

We don't need to flex these elements currently as they contain either no
children or inline elements only.

* style: prefer camelCase element names over hyphens

* Fix search result suggestion overflow on IE

Without this directive on the parent, it had no width or flex growth and
didn't respect the parent width. This allows it to take on the correct
flexed width, and thus take on the overflow rules.

* Remove unused CSS rule

We have an overriding align-items declaration immediately after this
one.
2019-09-11 13:24:31 -05:00
Spencer de7da0cd19
[optimize/bundleContext] do not include absolute urls or windo… (#45318)
* [optimize/bundleContext] do not include absolute urls or windows slashes

* simplify the stable clone fn, it doesn't need to be generic
2019-09-11 10:04:25 -07:00
Greg Thompson bec1fa63ab
Upgrade EUI to 13.8.1 (#45052)
* eui to 13.8.0

* euibutton ts updates

* euicontextmenupanel ts updates

* misc ts updates

* src snapshot updates

* x-pack snapshot updates

* 13.8.1
2019-09-11 10:03:02 -05:00
Robert Oskamp 9cd2f6e0b3
[ML] Add multi metric job wizard test (#45279)
This PR adds functional UI tests to create a machine learning job using the multi metric wizard.
2019-09-11 16:57:23 +02:00
Xavier Mouligneau 7cf69fdc99
[SIEM] Inject/apply KQL changed in refresh button (#45065)
* wip to apply kql when refresh on hosts page

* refactor to have less re-render

* add network and timeline page

* fix/add unit testing

* from review remove any effect from render

* clean up + review II

* review II + bug fixes

* review III
2019-09-11 10:42:55 -04:00
Joe Reuter 8b97cafc0f
[Graph] Type persistence (#44985) 2019-09-11 16:40:59 +02:00
Dmitry Lemeshko 8a900bfe09
Functional tests: convert more test/services to TS (#45176)
* convert more test/services to TS

* Update test/functional/services/combo_box.ts

Co-Authored-By: Tre' <wayne.seymour@elastic.co>

* Update test/functional/services/combo_box.ts

Co-Authored-By: Tre' <wayne.seymour@elastic.co>

* Update test/functional/services/combo_box.ts

Co-Authored-By: Tre' <wayne.seymour@elastic.co>

* fix lint error
2019-09-11 16:10:13 +02:00
Pete Harverson c1f1e154c6
[ML] Fixes display of matching modules in index data visualizer (#45261)
* [ML] Fixes display of matching modules in index data visualizer

* [ML] Update following review on adding recognizer check
2019-09-11 13:19:52 +01:00
Jean-Louis Leysens 98bf7bfdd6
[Console] Update indentation behaviour (#45249)
* SQL template with triple quote in completion

* Slight update to SQL query template and bugfix for collapse/expand of request bodies

* Add comment and slight update to triple quote expansion

* Updated tests after changes to newline behaviour

* Restore old backslash triple quote expansion behaviour

* Handle some more tricky cases, but make sure to preserve newlines.
Update tests for new cases too

* Make regex more specific
Expanded tests

* Now make it x-browser

* Slight refactor and renaming

* Update comment
2019-09-11 14:18:20 +02:00
Matthias Wilhelm 745d76dfcc
Convert value provided to PhraseValueInput to string to catch Exception (#45259) 2019-09-11 14:15:29 +02:00
Daniil Suleiman 32d98d5976 [Region Map] Fix loading default vector map and base layer setting (#43858)
* Fix loading default vector layer

* Move layers loading to vis initialization

* Move layers loading to editor initialization
2019-09-11 14:41:06 +03:00
James Gowdy d916e92f40
[ML] Fixing empty time range when cloning jobs (#45286)
* [ML] Fixing empty time range when cloning jobs

* removing if statement
2019-09-11 12:39:22 +01:00
James Gowdy 4f7ce19fbf
[ML] Fixing wizard validation delay (#45265)
* [ML] Fixing wizard validation delay

* changes based on review
2019-09-11 12:39:07 +01:00
Felix Stürmer 7202f51881
[Logs UI] Interpret finished analysis jobs as healthy (#45268)
This changes the job health check of the log analysis page to consider finished jobs as healthy. This situation is relevant when the job is non-continuous, i.e. created with a definite end date.

At the same time it ensures that datafeeds that failed to be started due to empty indices lead to the jobs being considered unhealthy.

fixes #45180
2019-09-11 13:13:28 +02:00
Jean-Louis Leysens 00b30e46ac
[Console] SQL template with triple quote in completion (#45248)
* SQL template with triple quote in completion

* Slight update to SQL query template and bugfix for collapse/expand of request bodies

* Add comment and slight update to triple quote expansion

* Updated tests after changes to newline behaviour

* Restore old backslash triple quote expansion behaviour
2019-09-11 10:06:27 +02:00
Dmitrii 190f28ab78
[ML] Data Frames: Cards as links (#45254)
* [ML] Data Frames: Cards as links

* [ML] PR remarks
2019-09-11 09:18:21 +02:00
WangQianliang 4d4a5b38f4
fix(code/frontend): should show updating instead of cloning when updating (#45238) 2019-09-11 14:05:00 +08:00
WangQianliang 6e4916fa0e
fix(code/frontend): fix document search result from (#45236) 2019-09-11 12:15:45 +08:00
spalger 95bf9c832a disable another flaky suite (#45323) (#45330) 2019-09-10 20:22:24 -07:00
spalger a7f5062741 disable flaky suite (#45105) 2019-09-10 18:18:52 -07:00
spalger 013bc3a504 skip flaky suite (#43069) 2019-09-10 18:07:58 -07:00
spalger 3a8d19d3a0 skip flaky suite (#45089) 2019-09-10 17:59:26 -07:00
spalger 61e1b83722 disable jest suite that has no enabled tests (#44250) 2019-09-10 17:53:45 -07:00
spalger 1834fe070a disable flaky test (#45317) 2019-09-10 17:40:53 -07:00
spalger d50892100b disable flaky test (#45315) 2019-09-10 17:29:38 -07:00
Lisa Cawley baee2390bf
[DOCS] Creates developer folder (#45280) 2019-09-10 17:13:23 -07:00
Frank Hassanabad cde2885e9c
[SIEM] Changes ML conditional links to use tabs, fixes a small bug with null filterQuery (#45218)
## Summary

Changes the ML drill-downs to use the tabs and re-direct to the Anomalies table when drilled down. 

https://github.com/elastic/kibana/issues/45080

Tests for this were both by playing with the Anomalies as well as hand testing that these clickable links below do what I would expect them to do based on the conditional rules of:

* Split comma separated values into OR clauses within KQL.
* Redirect from multiple hosts/ips on the details page to the host over view/detail overview page with a new KQL added as a filter since comma separated values on details would just be errors.
* Remove/Replace any $value$ dollar values that did not have a value as before.

Manual testing is from either the test cases below or by using the ML Anomalies explorerand clicking on the drill down links using the action menu items from Host or IP jobs which look like this:

<img width="352" alt="Screen Shot 2019-09-06 at 4 17 05 PM" src="https://user-images.githubusercontent.com/1151048/64576200-c1852780-d334-11e9-8270-ef97569a2e78.png">


URL manual test cases I used:

Testing conditional ml-network links:
-----

Single IP with a null for the KQL:
http://localhost:5601/app/siem#/ml-network/ip/127.0.0.1?kqlQuery=(filterQuery:!n,queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Single IP with kqlQuery:
http://localhost:5601/app/siem#/ml-network/ip/127.0.0.1?kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Multiple IP's with a null for the filterQuery:
http://localhost:5601/app/siem#/ml-network/ip/127.0.0.1,127.0.0.2?kqlQuery=(filterQuery:!n,queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Multiple IP's with a value for the filterQuery:
http://localhost:5601/app/siem#/ml-network/ip/127.0.0.1,127.0.0.2?kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Undefined/null IP and a null filterQuery:
http://localhost:5601/app/siem#/ml-network/ip/$ip$?kqlQuery=(filterQuery:!n,queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Undefined/null IP but a value for the filterQuery:
http://localhost:5601/app/siem#/ml-network/ip/$ip$?kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T11:00:00.000Z',kind:absolute,to:'2019-08-28T13:59:59.999Z')))


Testing conditional host links:


Single host name with a null for the KQL:
http://localhost:5601/app/siem#/ml-hosts/siem-windows?_g=()&kqlQuery=(filterQuery:!n,queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))


Single host name with a variable left in the KQL
http://localhost:5601/app/siem#/ml-hosts/siem-windows?_g=()&kqlQuery=(filterQuery:(expression:'process.name%20:%20%22$process.name$%22',kind:kuery),queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))


Single host name with a value for filterQuery:
http://localhost:5601/app/siem#/ml-hosts/siem-windows?_g=()&kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))


Multiple host names with null for filterQuery

http://localhost:5601/app/siem#/ml-hosts/siem-windows,siem-suricata?_g=()&kqlQuery=(filterQuery:!n,queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))

Multiple host names with a value for filterQuery
http://localhost:5601/app/siem#/ml-hosts/siem-windows,siem-suricata?_g=()&kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))


Undefined/null host name with a null for the KQL:
http://localhost:5601/app/siem#/ml-hosts/$host.name$?_g=()&kqlQuery=(filterQuery:!n,queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))


Undefined/null host name but with a value for filterQuery
http://localhost:5601/app/siem#/ml-hosts/$host.name$?_g=()&kqlQuery=(filterQuery:(expression:'process.name%20:%20%22conhost.exe,sc.exe%22',kind:kuery),queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-06-06T06:00:00.000Z',kind:absolute,to:'2019-06-07T05:59:59.999Z')))

----



Extra misc tests:

3 host names
http://localhost:5601/app/siem#/ml-hosts/suricata-iowa,siem-windows,siem-fake?_g=()&kqlQuery=(filterQuery:(expression:'process.name%20:%20%22snapd%22',kind:kuery),queryLocation:hosts.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-09-09T18:00:00.000Z',kind:absolute,to:'2019-09-09T20:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-09-09T18:00:00.000Z',kind:absolute,to:'2019-09-09T20:59:59.999Z')))


3 ips
http://localhost:5601/app/siem#/ml-network/ip/127.0.0.1,127.0.0.2,127.0.0.3?_g=()&kqlQuery=(filterQuery:!n,queryLocation:network.details,type:details)&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-28T06:00:00.000Z',kind:absolute,to:'2019-08-29T05:59:59.999Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-28T06:00:00.000Z',kind:absolute,to:'2019-08-29T05:59:59.999Z')))





### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

- [x] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)
- [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
- [x] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)

### For maintainers

- [x] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
2019-09-10 17:21:55 -06:00
Nathan Reese 67e9eaf6c6
[skip-ci][Maps] Update search docs (#45307)
* [skip ci][Maps] Update search document section with new features

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* Update docs/maps/search.asciidoc

Co-Authored-By: gchaps <33642766+gchaps@users.noreply.github.com>

* review feedback

* review feedback

* remove trailing .html from link
2019-09-10 15:22:59 -06:00