Merge branch 'master' into eui-22-3-0

.eslintrc.js

@@ -96,7 +96,7 @@ module.exports = {
       },
     },
     {
-      files: ['x-pack/legacy/plugins/cross_cluster_replication/**/*.{js,ts,tsx}'],
+      files: ['x-pack/plugins/cross_cluster_replication/**/*.{js,ts,tsx}'],
       rules: {
         'jsx-a11y/click-events-have-key-events': 'off',
       },

.sass-lint.yml

@@ -9,6 +9,7 @@ files:
     - 'x-pack/legacy/plugins/canvas/**/*.s+(a|c)ss'
     - 'x-pack/plugins/triggers_actions_ui/**/*.s+(a|c)ss'
     - 'x-pack/plugins/lens/**/*.s+(a|c)ss'
+    - 'x-pack/plugins/cross_cluster_replication/**/*.s+(a|c)ss'
     - 'x-pack/legacy/plugins/maps/**/*.s+(a|c)ss'
     - 'x-pack/plugins/maps/**/*.s+(a|c)ss'
   ignore:

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md

@@ -8,6 +8,7 @@
 
 ```typescript
 actions: {
-        createFiltersFromEvent: typeof createFiltersFromEvent;
+        createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
+        createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
     };
 ```

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md

@@ -14,7 +14,7 @@ export interface DataPublicPluginStart
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [actions](./kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md) | <code>{</code><br/><code>        createFiltersFromEvent: typeof createFiltersFromEvent;</code><br/><code>    }</code> |  |
+|  [actions](./kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md) | <code>{</code><br/><code>        createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;</code><br/><code>        createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;</code><br/><code>    }</code> |  |
 |  [autocomplete](./kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md) | <code>AutocompleteStart</code> |  |
 |  [fieldFormats](./kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md) | <code>FieldFormatsStart</code> |  |
 |  [indexPatterns](./kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md) | <code>IndexPatternsContract</code> |  |

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformats.md

@@ -10,7 +10,7 @@
 fieldFormats: {
     FieldFormat: typeof FieldFormat;
     FieldFormatsRegistry: typeof FieldFormatsRegistry;
-    serialize: (agg: import("./search").AggConfig) => import("../../expressions/common").SerializedFieldFormat<object>;
+    serialize: (agg: import("./search").AggConfig) => import("../../expressions").SerializedFieldFormat<object>;
     DEFAULT_CONVERTER_COLOR: {
         range: string;
         regex: string;

docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformats.md

@@ -10,7 +10,7 @@
 fieldFormats: {
     FieldFormatsRegistry: typeof FieldFormatsRegistry;
     FieldFormat: typeof FieldFormat;
-    serializeFieldFormat: (agg: import("../public/search").AggConfig) => import("../../expressions/common").SerializedFieldFormat<object>;
+    serializeFieldFormat: (agg: import("../public/search").AggConfig) => import("../../expressions").SerializedFieldFormat<object>;
     BoolFormat: typeof BoolFormat;
     BytesFormat: typeof BytesFormat;
     ColorFormat: typeof ColorFormat;

docs/management/advanced-options.asciidoc

@@ -217,6 +217,8 @@ might increase the search time. This setting is off by default. Users must opt-i
 [horizontal]
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
+`siem:ipReputationLinks`:: A JSON array containing links for verifying the reputation of an IP address. The links are displayed on
+{siem-guide}/siem-ui-overview.html#network-ui[IP detail] pages.
 `siem:enableNewsFeed`:: Enables the security news feed on the SIEM *Overview*
 page.
 `siem:newsFeedUrl`:: The URL from which the security news feed content is

docs/settings/ml-settings.asciidoc

@@ -8,7 +8,6 @@
 You do not need to configure any settings to use {kib} {ml-features}. They are
 enabled by default.
 
-[float]
 [[general-ml-settings-kb]]
 ==== General {ml} settings
 
@@ -19,3 +18,11 @@ If set to `false` in `kibana.yml`, the {ml} icon is hidden in this {kib}
 instance. If `xpack.ml.enabled` is set to `true` in `elasticsearch.yml`, however,
 you can still use the {ml} APIs. To disable {ml} entirely, see the
 {ref}/ml-settings.html[{es} {ml} settings].
+
+[[data-visualizer-settings]]
+==== {data-viz} settings
+
+`xpack.ml.file_data_visualizer.max_file_size`::
+Sets the file size limit when importing data in the {data-viz}. The default
+value is `100MB`. The highest supported value for this setting is `1GB`.
+

docs/siem/siem-ui.asciidoc

@@ -35,7 +35,7 @@ image::siem/images/network-ui.png[]
 
 [float]
 [[detections-ui]]
-=== Detections (Beta)
+=== Detections (beta)
 
 The Detections feature automatically searches for threats and creates 
 signals when they are detected. Signal detection rules define the conditions 
@@ -50,6 +50,22 @@ or the Detections API.
 [role="screenshot"]
 image::siem/images/detections-ui.png[]
 
+[float]
+[[cases-ui]]
+=== Cases (beta)
+
+Cases are used to open and track security issues directly in SIEM. 
+Cases list the original reporter and all users who contribute to a case
+(`participants`). Case comments support Markdown syntax, and allow linking to
+saved Timelines. Additionally, you can send cases to external systems from
+within SIEM (currently ServiceNow).
+
+For information about opening, updating, and closing cases, see
+{siem-guide}/cases-overview.html[Cases] in the SIEM Guide.
+
+[role="screenshot"]
+image::siem/images/cases-ui.png[]
+
 [float]
 [[timelines-ui]]
 === Timeline

docs/user/dashboard.asciidoc

@@ -98,6 +98,24 @@ to the new dimensions.
 * To delete a panel, open the panel menu and select *Delete from dashboard.* Deleting a panel from a
 dashboard does *not* delete the saved visualization or search.
 
+[float]
+[[cloning-a-panel]]
+=== Clone dashboard elements
+
+In *Edit* mode, you can clone any panel on a dashboard.
+
+To clone an existing panel, open the panel menu of the element you wish to clone, then select *Clone panel*.
+
+* Cloned panels appear beside the original, and will move other panels down to make room if necessary.
+
+* Clones support all of the original panel's functionality, including renaming, editing, and cloning.
+
+* All cloned visualizations will appear in the visualization list.
+
+[role="screenshot"]
+image:images/clone_panel.gif[clone panel]
+
+
 [float]
 [[viewing-detailed-information]]
 === Inspect and edit elements

docs/user/ml/index.asciidoc

@@ -4,31 +4,31 @@
 
 [partintro]
 --
-As datasets increase in size and complexity, the human effort required to
+As data sets increase in size and complexity, the human effort required to
 inspect dashboards or maintain rules for spotting infrastructure problems,
 cyber attacks, or business issues becomes impractical. Elastic {ml-features}
 such as {anomaly-detect} and {oldetection} make it easier to notice suspicious
 activities with minimal human interference.
 
-If you have a basic license, you can use the *Data Visualizer* to learn more
-about your data. In particular, if your data is stored in {es} and contains a
-time field, you can use the *Data Visualizer* to identify possible fields for
-{anomaly-detect}:
+{kib} includes a free *{data-viz}* to learn more about your data. In particular,
+if your data is stored in {es} and contains a time field, you can use the
+*{data-viz}* to identify possible fields for {anomaly-detect}:
 
 [role="screenshot"]
-image::user/ml/images/ml-data-visualizer-sample.jpg[Data Visualizer for sample flight data]
+image::user/ml/images/ml-data-visualizer-sample.jpg[{data-viz} for sample flight data]
 
-experimental[] You can also upload a CSV, NDJSON, or log file (up to 100 MB in 
-size). The *Data Visualizer* identifies the file format and field mappings. You 
-can then optionally import that data into an {es} index.
+experimental[] You can also upload a CSV, NDJSON, or log file. The *{data-viz}*
+identifies the file format and field mappings. You can then optionally import
+that data into an {es} index. To change the default file size limit, see
+<<data-visualizer-settings>>.
 
-You need the following permissions to use the Data Visualizer with file upload:
+You need the following permissions to use the {data-viz} with file upload:
 
 * cluster privileges: `monitor`, `manage_ingest_pipelines`
 * index privileges: `read`, `manage`, `index`
 
 For more information, see {ref}/security-privileges.html[Security privileges] 
-and {ref}/built-in-roles.html[Built-in roles].
+and {ml-docs}/setup.html[Set up {ml-features}].
 
 --
 

docs/visualize/for-dashboard.asciidoc

@@ -13,13 +13,29 @@ on a dashboard.
 
 You can add two types of interactive inputs:
 
-* *Options list* - Filters content based on one or more specified options. The dropdown menu is dynamically populated with the results of a terms aggregation. For example, use the options list on the sample flight dashboard when you want to filter the data by origin city and destination city.
+* *Options list* — Filters content based on one or more specified options. The dropdown menu is dynamically populated with the results of a terms aggregation. For example, use the options list on the sample flight dashboard when you want to filter the data by origin city and destination city.
 
-* *Range slider* - Filters data within a specified range of numbers. The minimum and maximum values are dynamically populated with the results of a min and max aggregation. For example, use the range slider when you want to filter the sample flight dashboard by a specific average ticket price.
+* *Range slider* — Filters data within a specified range of numbers. The minimum and maximum values are dynamically populated with the results of a min and max aggregation. For example, use the range slider when you want to filter the sample flight dashboard by a specific average ticket price.
 
 [role="screenshot"]
 image::images/dashboard-controls.png[]
 
+[float]
+[[controls-options]]
+==== Controls options
+
+Configure the settings that apply to the interactive inputs on a dashboard.
+
+. Click *Options*, then configure the following:
+
+* *Update {kib} filters on each change* — When selected, all interactive inputs create filters that refresh the dashboard. When unselected, {kib} filters are created only when you click *Apply changes*.
+
+* *Use time filter* &mdash; When selected, the aggregations that generate the options list and time range are connected to the <<set-time-filter,time filter>>.
+
+* *Pin filters to global state* &mdash; When selected, all filters created by interacting with the inputs are automatically pinned.
+
+. Click *Update*.
+
 [float]
 [[markdown-widget]]
 === Markdown

packages/kbn-storybook/storybook_config/webpack.config.js

@@ -49,6 +49,13 @@ module.exports = async ({ config }) => {
     },
   });
 
+  config.module.rules.push({
+    test: /\.(html|md|txt|tmpl)$/,
+    use: {
+      loader: 'raw-loader',
+    },
+  });
+
   // Handle Typescript files
   config.module.rules.push({
     test: /\.tsx?$/,

src/core/server/config/deprecation/core_deprecations.ts

@@ -128,56 +128,6 @@ export const coreDeprecationProvider: ConfigDeprecationProvider = ({
   renameFromRoot('optimize.lazyHost', 'optimize.watchHost'),
   renameFromRoot('optimize.lazyPrebuild', 'optimize.watchPrebuild'),
   renameFromRoot('optimize.lazyProxyTimeout', 'optimize.watchProxyTimeout'),
-  // Monitoring renames
-  // TODO: Remove these from here once the monitoring plugin is migrated to NP
-  renameFromRoot('xpack.monitoring.enabled', 'monitoring.enabled'),
-  renameFromRoot('xpack.monitoring.ui.enabled', 'monitoring.ui.enabled'),
-  renameFromRoot(
-    'xpack.monitoring.kibana.collection.enabled',
-    'monitoring.kibana.collection.enabled'
-  ),
-  renameFromRoot('xpack.monitoring.max_bucket_size', 'monitoring.ui.max_bucket_size'),
-  renameFromRoot('xpack.monitoring.min_interval_seconds', 'monitoring.ui.min_interval_seconds'),
-  renameFromRoot(
-    'xpack.monitoring.show_license_expiration',
-    'monitoring.ui.show_license_expiration'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.ui.container.elasticsearch.enabled',
-    'monitoring.ui.container.elasticsearch.enabled'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.ui.container.logstash.enabled',
-    'monitoring.ui.container.logstash.enabled'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.tests.cloud_detector.enabled',
-    'monitoring.tests.cloud_detector.enabled'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.kibana.collection.interval',
-    'monitoring.kibana.collection.interval'
-  ),
-  renameFromRoot('xpack.monitoring.elasticsearch.hosts', 'monitoring.ui.elasticsearch.hosts'),
-  renameFromRoot('xpack.monitoring.elasticsearch.username', 'monitoring.ui.elasticsearch.username'),
-  renameFromRoot('xpack.monitoring.elasticsearch.password', 'monitoring.ui.elasticsearch.password'),
-  renameFromRoot(
-    'xpack.monitoring.xpack_api_polling_frequency_millis',
-    'monitoring.xpack_api_polling_frequency_millis'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.cluster_alerts.email_notifications.enabled',
-    'monitoring.cluster_alerts.email_notifications.enabled'
-  ),
-  renameFromRoot(
-    'xpack.monitoring.cluster_alerts.email_notifications.email_address',
-    'monitoring.cluster_alerts.email_notifications.email_address'
-  ),
-  renameFromRoot('xpack.monitoring.ccs.enabled', 'monitoring.ui.ccs.enabled'),
-  renameFromRoot(
-    'xpack.monitoring.elasticsearch.logFetchCount',
-    'monitoring.ui.elasticsearch.logFetchCount'
-  ),
   configPathDeprecation,
   dataPathDeprecation,
   rewriteBasePathDeprecation,

src/dev/build/tasks/nodejs_modules/clean_client_modules_on_dll_task.js

@@ -48,12 +48,12 @@ export const CleanClientModulesOnDLLTask = {
     ];
     const discoveredLegacyCorePluginEntries = await globby([
       `${baseDir}/src/legacy/core_plugins/*/index.js`,
-      // Small exception to load dynamically discovered functions for timelion plugin
-      `${baseDir}/src/legacy/core_plugins/timelion/server/*_functions/**/*.js`,
       `!${baseDir}/src/legacy/core_plugins/**/public`,
     ]);
     const discoveredPluginEntries = await globby([
       `${baseDir}/src/plugins/*/server/index.js`,
+      // Small exception to load dynamically discovered functions for timelion plugin
+      `${baseDir}/src/plugins/vis_type_timelion/server/*_functions/**/*.js`,
       `!${baseDir}/src/plugins/**/public`,
     ]);
     const discoveredNewPlatformXpackPlugins = await globby([

src/dev/precommit_hook/casing_check_config.js

@@ -116,11 +116,6 @@ export const TEMPORARILY_IGNORED_PATHS = [
   'src/legacy/core_plugins/tile_map/public/__tests__/scaledCircleMarkers.png',
   'src/legacy/core_plugins/tile_map/public/__tests__/shadedCircleMarkers.png',
   'src/legacy/core_plugins/tile_map/public/__tests__/shadedGeohashGrid.png',
-  'src/legacy/core_plugins/timelion/server/lib/asSorted.js',
-  'src/legacy/core_plugins/timelion/server/lib/unzipPairs.js',
-  'src/legacy/core_plugins/timelion/server/series_functions/__tests__/fixtures/bucketList.js',
-  'src/legacy/core_plugins/timelion/server/series_functions/__tests__/fixtures/seriesList.js',
-  'src/legacy/core_plugins/timelion/server/series_functions/__tests__/fixtures/tlConfig.js',
   'src/fixtures/config_upgrade_from_4.0.0_to_4.0.1-snapshot.json',
   'src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/lib/fixtures/mock_data/terms/_seriesMultiple.js',
   'src/core/server/core_app/assets/favicons/android-chrome-192x192.png',

src/legacy/core_plugins/kibana/public/discover/plugin.ts

@@ -147,6 +147,9 @@ export class DiscoverPlugin implements Plugin<void, void> {
         await this.initializeServices();
         await this.initializeInnerAngular();
 
+        // make sure the index pattern list is up to date
+        const [, { data: dataStart }] = await core.getStartServices();
+        await dataStart.indexPatterns.clearCache();
         const { renderApp } = await import('./np_ready/application');
         const unmount = await renderApp(innerAngularName, params.element);
         return () => {

src/legacy/core_plugins/vis_type_vislib/public/plugin.ts

@@ -108,6 +108,6 @@ export class VisTypeVislibPlugin implements Plugin<void, void> {
 
   public start(core: CoreStart, { data }: VisTypeVislibPluginStartDependencies) {
     setFormatService(data.fieldFormats);
-    setDataActions({ createFiltersFromEvent: data.actions.createFiltersFromEvent });
+    setDataActions(data.actions);
   }
 }

src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.test.tsx

@@ -36,7 +36,9 @@ jest.mock('../../../legacy_imports', () => ({
 }));
 
 jest.mock('../../../services', () => ({
-  getDataActions: () => ({ createFiltersFromEvent: jest.fn().mockResolvedValue(['yes']) }),
+  getDataActions: () => ({
+    createFiltersFromValueClickAction: jest.fn().mockResolvedValue(['yes']),
+  }),
 }));
 
 const vis = {

src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.tsx

@@ -101,7 +101,7 @@ export class VisLegend extends PureComponent<VisLegendProps, VisLegendState> {
       return false;
     }
 
-    const filters = await getDataActions().createFiltersFromEvent(item.values);
+    const filters = await getDataActions().createFiltersFromValueClickAction({ data: item.values });
     return Boolean(filters.length);
   };
 

src/legacy/core_plugins/vis_type_vislib/public/vislib/lib/handler.js

@@ -83,10 +83,21 @@ export class Handler {
 
     // memoize so that the same function is returned every time,
     // allowing us to remove/re-add the same function
-    this.getProxyHandler = _.memoize(function(event) {
+    this.getProxyHandler = _.memoize(function(eventType) {
       const self = this;
-      return function(e) {
-        self.vis.emit(event, e);
+      return function(eventPayload) {
+        switch (eventType) {
+          case 'brush':
+            const xRaw = _.get(eventPayload.data, 'series[0].values[0].xRaw');
+            if (!xRaw) return; // not sure if this is possible?
+            return self.vis.emit(eventType, {
+              table: xRaw.table,
+              range: eventPayload.range,
+              column: xRaw.column,
+            });
+          case 'click':
+            return self.vis.emit(eventType, eventPayload);
+        }
       };
     });
 

src/legacy/ui/public/new_platform/new_platform.karma_mock.js

@@ -377,7 +377,8 @@ export const npStart = {
     },
     data: {
       actions: {
-        createFiltersFromEvent: Promise.resolve(['yes']),
+        createFiltersFromValueClickAction: Promise.resolve(['yes']),
+        createFiltersFromRangeSelectAction: sinon.fake(),
       },
       autocomplete: {
         getProvider: sinon.fake(),