Merge branch 'master' of github.com:elastic/kibana into dev/dont-dele…

…te-error-searches

docs/maps/vector-layer.asciidoc

@@ -20,10 +20,10 @@ The index must contain at least one field mapped as {ref}/geo-point.html[geo_poi
 Results are limited to the `index.max_result_window` index setting, which defaults to 10000.
 Select the appropriate *Scaling* option for your use case.
 +
-* *Limit results to 10000.* The layer displays features from the first `index.max_result_window` documents.
+* *Limit results to 10,000* The layer displays features from the first `index.max_result_window` documents.
 Results exceeding `index.max_result_window` are not displayed.
 
-* *Show clusters when results exceed 10000.* When results exceed `index.max_result_window`, the layer uses {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into clusters and displays metrics for each cluster. When results are less then `index.max_result_window`, the layer displays features from individual documents.
+* *Show clusters when results exceed 10,000* When results exceed `index.max_result_window`, the layer uses {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into clusters and displays metrics for each cluster. When results are less then `index.max_result_window`, the layer displays features from individual documents.
 
 * *Use vector tiles.* Vector tiles partition your map into 6 to 8 tiles.
 Each tile request is limited to the `index.max_result_window` index setting.

docs/user/management.asciidoc

@@ -82,9 +82,10 @@ connectors>> for triggering actions.
 | Monitor the generation of reports—PDF, PNG, and CSV—and download reports that you previously generated.
 A report can contain a dashboard, visualization, saved search, or Canvas workpad.
 
-| {ml-docs}/ml-jobs.html[Machine Learning Jobs]
-| View your {anomaly-jobs} and {dfanalytics-jobs}. Open the Single Metric
-Viewer or Anomaly Explorer to see your {ml} results.
+| Machine Learning Jobs
+| View your <<xpack-ml-anomalies,{anomaly-detect}>> and
+<<xpack-ml-dfanalytics,{dfanalytics}>> jobs. Open the Single Metric
+Viewer or Anomaly Explorer to see your {anomaly-detect} results.
 
 | <<watcher-ui, Watcher>>
 | Detect changes in your data by creating, managing, and monitoring alerts.

docs/user/ml/index.asciidoc

@@ -48,8 +48,9 @@ pane:
 image::user/ml/images/ml-job-management.png[Job Management]
 
 You can use the *Settings* pane to create and edit
-{ml-docs}/ml-calendars.html[calendars] and the filters that are used in
-{ml-docs}/ml-rules.html[custom rules]:
+{ml-docs}/ml-ad-finding-anomalies.html#ml-ad-calendars[calendars] and the
+filters that are used in
+{ml-docs}/ml-ad-finding-anomalies.html#ml-ad-rules[custom rules]:
 
 [role="screenshot"]
 image::user/ml/images/ml-settings.png[Calendar Management]

packages/kbn-securitysolution-list-utils/src/autocomplete_operators/index.ts

@@ -11,8 +11,7 @@ import {
   ListOperatorEnum as OperatorEnum,
   ListOperatorTypeEnum as OperatorTypeEnum,
 } from '@kbn/securitysolution-io-ts-list-types';
-
-import { OperatorOption } from './types';
+import { OperatorOption } from '../types';
 
 export const isOperator: OperatorOption = {
   message: i18n.translate('lists.exceptions.isOperatorLabel', {

packages/kbn-securitysolution-list-utils/src/helpers/index.ts

@@ -43,7 +43,6 @@ import {
   isOneOfOperator,
   isOperator,
 } from '../autocomplete_operators';
-import { OperatorOption } from '../autocomplete_operators/types';
 
 import {
   BuilderEntry,
@@ -52,6 +51,7 @@ import {
   EmptyNestedEntry,
   ExceptionsBuilderExceptionItem,
   FormattedBuilderEntry,
+  OperatorOption,
 } from '../types';
 
 export const isEntryNested = (item: BuilderEntry): item is EntryNested => {

packages/kbn-securitysolution-list-utils/src/types/index.ts

@@ -23,7 +23,12 @@ import {
   EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
 } from '@kbn/securitysolution-list-constants';
 
-import type { OperatorOption } from '../autocomplete_operators/types';
+export interface OperatorOption {
+  message: string;
+  value: string;
+  operator: OperatorEnum;
+  type: OperatorTypeEnum;
+}
 
 /**
  * @deprecated Use the one from core once it is in its own package which will be from:

src/core/public/doc_links/doc_links_service.ts

@@ -232,20 +232,20 @@ export class DocLinksService {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/index.html`,
           aggregations: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-aggregation.html`,
           anomalyDetection: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-overview.html`,
-          anomalyDetectionJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-jobs.html`,
+          anomalyDetectionJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html`,
           anomalyDetectionConfiguringCategories: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-categories.html`,
-          anomalyDetectionBucketSpan: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#bucket-span`,
-          anomalyDetectionCardinality: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#cardinality`,
-          anomalyDetectionCreateJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html`,
-          anomalyDetectionDetectors: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#detectors`,
-          anomalyDetectionInfluencers: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-influencers.html`,
+          anomalyDetectionBucketSpan: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-bucket-span`,
+          anomalyDetectionCardinality: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-cardinality`,
+          anomalyDetectionCreateJobs: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-create-job`,
+          anomalyDetectionDetectors: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-detectors`,
+          anomalyDetectionInfluencers: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-influencers`,
           anomalyDetectionJobResource: `${ELASTICSEARCH_DOCS}ml-put-job.html#ml-put-job-path-parms`,
           anomalyDetectionJobResourceAnalysisConfig: `${ELASTICSEARCH_DOCS}ml-put-job.html#put-analysisconfig`,
-          anomalyDetectionJobTips: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#job-tips`,
-          anomalyDetectionModelMemoryLimits: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/create-jobs.html#model-memory-limits`,
-          calendars: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-calendars.html`,
+          anomalyDetectionJobTips: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-job-tips`,
+          anomalyDetectionModelMemoryLimits: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-model-memory-limits`,
+          calendars: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-calendars`,
           classificationEvaluation: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfa-classification.html#ml-dfanalytics-classification-evaluation`,
-          customRules: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-rules.html`,
+          customRules: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-ad-finding-anomalies.html#ml-ad-rules`,
           customUrls: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-configuring-url.html`,
           dataFrameAnalytics: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-dfanalytics.html`,
           featureImportance: `${ELASTIC_WEBSITE_URL}guide/en/machine-learning/${DOC_LINK_VERSION}/ml-feature-importance.html`,

src/core/server/core_app/bundle_routes/file_hash.test.ts

@@ -67,6 +67,8 @@ describe('getFileHash', () => {
     await getFileHash(cache, sampleFilePath, stats, fd);
 
     expect(cache.set).toHaveBeenCalledTimes(1);
-    expect(cache.set).toHaveBeenCalledWith(`${sampleFilePath}-${stats.ino}`, computedHashPromise);
+    expect(cache.set).toHaveBeenCalledWith(`${sampleFilePath}-${stats.ino}`, expect.any(Promise));
+    const promiseValue = await cache.set.mock.calls[0][1];
+    expect(promiseValue).toEqual('computed-hash');
   });
 });

src/plugins/discover/public/application/apps/main/services/use_saved_search.ts

@@ -279,13 +279,21 @@ export const useSavedSearch = ({
     ).pipe(debounceTime(100));
 
     const subscription = fetch$.subscribe((val) => {
-      fetchAll(val === 'reset');
+      try {
+        fetchAll(val === 'reset');
+      } catch (error) {
+        data$.next({
+          state: FetchStatus.ERROR,
+          fetchError: error,
+        });
+      }
     });
 
     return () => {
       subscription.unsubscribe();
     };
   }, [
+    data$,
     data.query.queryString,
     filterManager,
     refetch$,

src/plugins/discover/public/application/components/table/table.test.tsx

@@ -334,6 +334,33 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
             },
           },
         },
+        {
+          name: 'city',
+          displayName: 'city',
+          type: 'keyword',
+          isMapped: true,
+          readFromDocValues: true,
+          searchable: true,
+          shortDotsEnable: false,
+          scripted: false,
+          filterable: false,
+        },
+        {
+          name: 'city.raw',
+          displayName: 'city.raw',
+          type: 'string',
+          isMapped: true,
+          spec: {
+            subType: {
+              multi: {
+                parent: 'city',
+              },
+            },
+          },
+          shortDotsEnable: false,
+          scripted: false,
+          filterable: false,
+        },
       ],
     },
     metaFields: ['_index', '_type', '_score', '_id'],
@@ -380,6 +407,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       customer_first_name: 'Betty',
       'customer_first_name.keyword': 'Betty',
       'customer_first_name.nickname': 'Betsy',
+      'city.raw': 'Los Angeles',
     },
   };
   const props = {
@@ -417,6 +445,8 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       findTestSubject(component, 'tableDocViewRow-customer_first_name.nickname-multifieldBadge')
         .length
     ).toBe(1);
+
+    expect(findTestSubject(component, 'tableDocViewRow-city.raw').length).toBe(1);
   });
 
   it('does not render multifield rows if showMultiFields flag is not set', () => {
@@ -449,5 +479,7 @@ describe('DocViewTable at Discover Doc with Fields API', () => {
       findTestSubject(component, 'tableDocViewRow-customer_first_name.nickname-multifieldBadge')
         .length
     ).toBe(0);
+
+    expect(findTestSubject(component, 'tableDocViewRow-city.raw').length).toBe(1);
   });
 });

src/plugins/discover/public/application/components/table/table.tsx

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import { EuiInMemoryTable } from '@elastic/eui';
 import { IndexPattern, IndexPatternField } from '../../../../../data/public';
 import { SHOW_MULTIFIELDS } from '../../../../common';
@@ -60,6 +60,8 @@ export const DocViewerTable = ({
     indexPattern?.fields,
   ]);
 
+  const [childParentFieldsMap] = useState({} as Record<string, string>);
+
   const formattedHit = useMemo(() => indexPattern?.formatHit(hit, 'html'), [hit, indexPattern]);
 
   const tableColumns = useMemo(() => {
@@ -92,11 +94,21 @@ export const DocViewerTable = ({
   }
 
   const flattened = indexPattern.flattenHit(hit);
+  Object.keys(flattened).forEach((key) => {
+    const field = mapping(key);
+    if (field && field.spec?.subType?.multi?.parent) {
+      childParentFieldsMap[field.name] = field.spec.subType.multi.parent;
+    }
+  });
   const items: FieldRecord[] = Object.keys(flattened)
     .filter((fieldName) => {
       const fieldMapping = mapping(fieldName);
       const isMultiField = !!fieldMapping?.spec?.subType?.multi;
-      return isMultiField ? showMultiFields : true;
+      if (!isMultiField) {
+        return true;
+      }
+      const parent = childParentFieldsMap[fieldName];
+      return showMultiFields || (parent && !flattened.hasOwnProperty(parent));
     })
     .sort((fieldA, fieldB) => {
       const mappingA = mapping(fieldA);

test/functional/apps/discover/_date_nested.ts

@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['common', 'timePicker', 'discover']);
+  const security = getService('security');
+
+  describe('timefield is a date in a nested field', function () {
+    before(async function () {
+      await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/date_nested');
+      await security.testUser.setRoles(['kibana_admin', 'kibana_date_nested']);
+      await PageObjects.common.navigateToApp('discover');
+    });
+
+    after(async function unloadMakelogs() {
+      await security.testUser.restoreDefaults();
+      await esArchiver.unload('test/functional/fixtures/es_archiver/date_nested');
+    });
+
+    it('should show an error message', async function () {
+      await PageObjects.discover.selectIndexPattern('date-nested');
+      await PageObjects.discover.waitUntilSearchingHasFinished();
+      await testSubjects.existOrFail('discoverNoResultsError');
+    });
+  });
+}

test/functional/apps/discover/index.ts

@@ -51,5 +51,6 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./_indexpattern_with_unmapped_fields'));
     loadTestFile(require.resolve('./_runtime_fields_editor'));
     loadTestFile(require.resolve('./_huge_fields'));
+    loadTestFile(require.resolve('./_date_nested'));
   });
 }

test/functional/config.js

@@ -247,6 +247,21 @@ export default async function ({ readConfigFile }) {
           },
           kibana: [],
         },
+
+        kibana_date_nested: {
+          elasticsearch: {
+            cluster: [],
+            indices: [
+              {
+                names: ['date-nested'],
+                privileges: ['read', 'view_index_metadata'],
+                field_security: { grant: ['*'], except: [] },
+              },
+            ],
+            run_as: [],
+          },
+          kibana: [],
+        },
         kibana_message_with_newline: {
           elasticsearch: {
             cluster: [],

test/functional/fixtures/es_archiver/date_nested/data.json

@@ -0,0 +1,30 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "index-pattern:date-nested",
+    "index": ".kibana",
+    "source": {
+      "index-pattern": {
+       "fields":"[]",
+        "timeFieldName": "@timestamp",
+        "title": "date-nested"
+      },
+      "type": "index-pattern"
+    }
+  }
+}
+
+
+{
+  "type": "doc",
+  "value": {
+    "id": "date-nested-1",
+    "index": "date-nested",
+    "source": {
+      "message" : "test",
+      "nested": {
+        "timestamp": "2021-06-30T12:00:00.123Z"
+      }
+    }
+  }
+}

test/functional/fixtures/es_archiver/date_nested/mappings.json

@@ -0,0 +1,22 @@
+{
+  "type": "index",
+  "value": {
+    "index": "date-nested",
+    "mappings": {
+      "properties": {
+        "message": {
+          "type": "text"
+        },
+        "nested": {
+          "type": "nested"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}

x-pack/plugins/apm/public/components/app/Settings/agent_configurations/index.tsx

@@ -18,7 +18,6 @@ import { i18n } from '@kbn/i18n';
 import { isEmpty } from 'lodash';
 import React from 'react';
 import { useLocation } from 'react-router-dom';
-import { useTrackPageview } from '../../../../../../observability/public';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { createAgentConfigurationHref } from '../../../shared/Links/apm/agentConfigurationLinks';
@@ -34,9 +33,6 @@ export function AgentConfigurations() {
     { preservePreviousData: false, showToastOnError: false }
   );
 
-  useTrackPageview({ app: 'apm', path: 'agent_configuration' });
-  useTrackPageview({ app: 'apm', path: 'agent_configuration', delay: 15000 });
-
   const hasConfigurations = !isEmpty(data.configurations);
 
   return (